Kyverno has released version 1.19.2 fixing critical flaws that let tenants take over Kubernetes clusters, including CVE-2026-122311, rated CVSS 9.9 in the vendor advisory. Administrators running affected versions should patch now.

CVE-2026-122311 is a path traversal flaw in namespaced CEL policies. Kyverno from version 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert ".." segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

Sibling flaws and patching advice

The release also fixes sibling flaws CVE-2026-122310 and CVE-2026-122303, which carry the same critical severity in the advisory. The vendor advisory is GHSA-4pqm-wqq6-h9q2. Some third-party trackers list a lower CVSS score of 9.4 for CVE-2026-122311; this report uses 9.9 from the vendor advisory.

No public exploit code has been confirmed for CVE-2026-122311, and the flaw is not recorded in CISA's Known Exploited Vulnerabilities catalogue as being actively exploited. That does not mean the flaws are harmless — it means this is a patch-now warning, not a report of attacks already under way. Organisations should upgrade to Kyverno 1.19.2 or later and restrict who can create namespaced policies.

Sources: Kyverno security advisory GHSA-4pqm-wqq6-h9q2 via StackFlag, CVE-2026-122311: Kyverno policies can read and modify any cluster data, 5 November 2026; TheHackerWire, CVE-2026-122311: Path Traversal — Analysis & Fix, 5 November 2026.