# CVE-2026-122303

Auth bypass lets namespace tenants overwrite resources across namespaces.

- Page: https://www.vulneraibility.com/cve/CVE-2026-122303
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.33% (percentile 26.3)
- Weakness: CWE-862
- Published: 2026-11-05

## Affected versions

- kyverno: affected >= 1.17.0 and < 1.19.2; fixed in 1.19.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Namespace tenants can trick the privileged Kyverno controller to overwrite Secrets, Deployments, and policies in other namespaces (cluster‑wide privilege escalation).

## Action

Immediate action required

## Recommendation

Upgrade Kyverno to >=1.19.2 immediately; audit/restrict NamespacedMutatingPolicy and rotate exposed secrets.

## References

- [advisory] https://github.com/kyverno/kyverno/security/advisories/GHSA-jcw5-3wcg-fqx5
- [advisory] https://www.vulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-cross-namespace-resource-overwrite-via-namespacedmutatingpolicy

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.