# CVE-2026-122311

Path traversal in Kyverno lets namespaced policies escape and enables cluster takeover.

- Page: https://www.vulneraibility.com/cve/CVE-2026-122311
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-22
- Published: 2026-11-05

## Affected versions

- kyverno: affected >= 1.16.0 and < 1.19.2; fixed in 1.19.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Path-traversal in resource.get()/post() lets a NamespacedValidatingPolicy read/write cluster objects as the admission controller SA, enabling full cluster takeover.

## Action

Immediate action required

## Recommendation

Upgrade Kyverno to >=1.19.2, rotate/revoke admission SA creds, audit NamespacedValidatingPolicy and RBAC.

## References

- [advisory] https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2
- [advisory] https://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.