# Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses · pwn.watch

> Kyverno, the Kubernetes policy engine, fixed 24 security advisories (9 critical, 14 high, 1 moderate) in v1.19.2, released Oct 20; the CVE ids were published Nov 5. The worst bugs, rated CVSS 9.9 by the maintainers, let a user who can only create a policy in their own namespace escape it: an apiCall urlPath that hides ../ behind a ? or # separator (CVE-2026-122310, an incomplete fix of an earlier bug), CEL resource arguments and CleanupPolicy context loaders that reach other namespaces (CVE-2026-122311, CVE-2026-122304), and NamespacedMutatingPolicy mutateExisting targets that overwrite resources anywhere (CVE-2026-122303, CVE-2026-122313). Requests run as Kyverno's own ServiceAccount, which can create webhook configurations, so the maintainers say this reaches cluster admin. Other fixes cover image verification bypasses (a forged annotation, an attestation-type panic, a signature cache bypass, cosign keyless checks passing with empty SAN certificates), PolicyException and generate-rule bypasses, and several denial-of-service bugs. Multi-tenant clusters where tenants can write namespaced Kyverno policies are most at risk. Upgrade to 1.19.2 (Helm chart 3.9.2). No exploitation reported.

Page: https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026 · generated 2026-11-05T03:42:22.129Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Kyverno (Kubernetes policy engine)
- Started: 2026-10-20
- CVEs: CVE-2026-122302, CVE-2026-122303, CVE-2026-122304, CVE-2026-122305, CVE-2026-122306, CVE-2026-122307, CVE-2026-122308, CVE-2026-122309, CVE-2026-122310, CVE-2026-122311, CVE-2026-122312, CVE-2026-122313, CVE-2026-122314, CVE-2026-122315, CVE-2026-122316, CVE-2026-122318, CVE-2026-122319, CVE-2026-122320, CVE-2026-122321, CVE-2026-122322, CVE-2026-122323
- Affected: Kyverno up to and including 1.19.1 (most advisories; some start at 1.11.0, 1.16.0, 1.17.0, 1.18.0 or 1.19.1)
- Fixed in: Kyverno 1.19.2; Kyverno Helm chart 3.9.2

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026.json
- This file: https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-05: CVE ids CVE-2026-122302 through CVE-2026-122323 are published for the advisories. (https://www.cve.org/CVERecord?id=CVE-2026-122310)
- 2026-10-21: Kyverno publishes the advisories, including GHSA-3xfv-vq8x-qhg4 (namespace user to cluster admin via apiCall urlPath, 9.9) and GHSA-jcw5-3wcg-fqx5 (cross-namespace overwrite via NamespacedMutatingPolicy, 9.9). (https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4)
- 2026-10-20: Kyverno 1.19.2 is released, addressing 24 GitHub security advisories (9 critical, 14 high, 1 moderate). (https://github.com/kyverno/kyverno/releases/tag/v1.19.2)

## Fix brief
# Security brief: Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses

Source: https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026 · status: live · severity: critical · updated Nov 5, 2026, 02:53 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Kyverno, the Kubernetes policy engine, fixed 24 security advisories (9 critical, 14 high, 1 moderate) in v1.19.2, released Oct 20; the CVE ids were published Nov 5. The worst bugs, rated CVSS 9.9 by the maintainers, let a user who can only create a policy in their own namespace escape it: an apiCall urlPath that hides ../ behind a ? or # separator (CVE-2026-122310, an incomplete fix of an earlier bug), CEL resource arguments and CleanupPolicy context loaders that reach other namespaces (CVE-2026-122311, CVE-2026-122304), and NamespacedMutatingPolicy mutateExisting targets that overwrite resources anywhere (CVE-2026-122303, CVE-2026-122313). Requests run as Kyverno's own ServiceAccount, which can create webhook configurations, so the maintainers say this reaches cluster admin. Other fixes cover image verification bypasses (a forged annotation, an attestation-type panic, a signature cache bypass, cosign keyless checks passing with empty SAN certificates), PolicyException and generate-rule bypasses, and several denial-of-service bugs. Multi-tenant clusters where tenants can write namespaced Kyverno policies are most at risk. Upgrade to 1.19.2 (Helm chart 3.9.2). No exploitation reported.

Severity detail: CVSS 9.9 for the worst advisories per the Kyverno maintainers; exploiting them needs permission to create namespaced Kyverno policies; no reported exploitation and not in CISA KEV as of Nov 5

- Product: Kyverno (Kubernetes policy engine)
- CVE / advisory ids: CVE-2026-122302, CVE-2026-122303, CVE-2026-122304, CVE-2026-122305, CVE-2026-122306, CVE-2026-122307, CVE-2026-122308, CVE-2026-122309, CVE-2026-122310, CVE-2026-122311, CVE-2026-122312, CVE-2026-122313, CVE-2026-122314, CVE-2026-122315, CVE-2026-122316, CVE-2026-122318, CVE-2026-122319, CVE-2026-122320, CVE-2026-122321, CVE-2026-122322, CVE-2026-122323

## Affected versions
- Kyverno up to and including 1.19.1 (most advisories; some start at 1.11.0, 1.16.0, 1.17.0, 1.18.0 or 1.19.1)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Kyverno 1.19.2
- Kyverno Helm chart 3.9.2

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 5, 2026: CVE ids CVE-2026-122302 through CVE-2026-122323 are published for the advisories.
- Oct 21, 2026: Kyverno publishes the advisories, including GHSA-3xfv-vq8x-qhg4 (namespace user to cluster admin via apiCall urlPath, 9.9) and GHSA-jcw5-3wcg-fqx5 (cross-namespace overwrite via NamespacedMutatingPolicy, 9.9).
- Oct 20, 2026: Kyverno 1.19.2 is released, addressing 24 GitHub security advisories (9 critical, 14 high, 1 moderate).

## Advisories
- [Kyverno v1.19.2 release notes (security section)](https://github.com/kyverno/kyverno/releases/tag/v1.19.2) (Kyverno)
- [GHSA-3xfv-vq8x-qhg4: Privilege escalation to cluster admin via Policy apiCall urlPath](https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4) (Kyverno)
- [GHSA-jcw5-3wcg-fqx5: NamespacedMutatingPolicy mutate-existing enables cross-namespace resource overwrite](https://github.com/kyverno/kyverno/security/advisories/GHSA-jcw5-3wcg-fqx5) (Kyverno)
- [GHSA-h3pm-q9ww-f439: ClusterPolicy image verification bypass via forged annotation](https://github.com/kyverno/kyverno/security/advisories/GHSA-h3pm-q9ww-f439) (Kyverno)
- [CVE-2026-122310 record](https://www.cve.org/CVERecord?id=CVE-2026-122310) (CVE.org)

---
Machine-readable: https://pwn.watch/i/kyverno-1-19-2-multi-tenant-privesc-image-verify-bypass-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.