Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100707Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

High 7.7

In plain English

A high-severity path traversal in kyverno from kyverno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	0 – before 1.19.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-c5qq-7g2q-cpqp) vendor-advisory
VulnCheck Advisory: Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path third-party-advisory