1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath
Not on CISA's list of exploited flaws, and not in the news we track.
9.9of 10, critical
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-122310. Nothing runs until you send it.
Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's ServiceAccount, gaining cluster admin.
You are affected if
The fix