Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses ยท updates https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026 Kyverno, the Kubernetes policy engine, fixed 24 security advisories (9 critical, 14 high, 1 moderate) in v1.19.2, released Oct 20; the CVE ids were published Nov 5. The worst bugs, rated CVSS 9.9 by the maintainers, let a user who can only create a policy in their own namespace escape it: an apiCall urlPath that hides ../ behind a ? or # separator (CVE-2026-122310, an incomplete fix of an earlier bug), CEL resource arguments and CleanupPolicy context loaders that reach other namespaces (CVE-2026-122311, CVE-2026-122304), and NamespacedMutatingPolicy mutateExisting targets that overwrite resources anywhere (CVE-2026-122303, CVE-2026-122313). Requests run as Kyverno's own ServiceAccount, which can create webhook configurations, so the maintainers say this reaches cluster admin. Other fixes cover image verification bypasses (a forged annotation, an attestation-type panic, a signature cache bypass, cosign keyless checks passing with empty SAN certificates), PolicyException and generate-rule bypasses, and several denial-of-service bugs. Multi-tenant clusters where tenants can write namespaced Kyverno policies are most at risk. Upgrade to 1.19.2 (Helm chart 3.9.2). No exploitation reported. en Thu, 05 Nov 2026 00:00:00 GMT Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses: CVE ids CVE-2026-122302 through CVE-2026-122323 are published for the advisories. https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026 https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026#2026-11-05-c8046f63 Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-122310">Source</a></p> Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses: Kyverno publishes the advisories, including GHSA-3xfv-vq8x-qhg4 (namespace user to cluster admin via apiCall urlPath, 9.9) and GHSA-jcw5-3wcg-fqx5 (cross-namespace overwrite via NamespacedMutatingPolicy, 9.9). https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026 https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026#2026-10-21-88f7d884 Wed, 21 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4">Source</a></p> Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses: Kyverno 1.19.2 is released, addressing 24 GitHub security advisories (9 critical, 14 high, 1 moderate). https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026 https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026#2026-10-20-e4ee24fe Tue, 20 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/kyverno/kyverno/releases/tag/v1.19.2">Source</a></p>