9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22039

CVE-2026-22039: Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved urlPath is executed using the Kyverno admission controller ServiceAccount, with no enforcement that the request is limited to the policy’s namespace. As a result, any authenticated user with permission to create a namespaced Policy can cause Kyverno to perform Kubernetes API requests using Kyverno’s admission controller identity, targeting any API path allowed by that ServiceAccount’s RBAC. This breaks namespace isolation by enabling cross-namespace reads (for example, ConfigMaps and, where permitted, Secrets) and allows cluster-scoped or cross-namespace writes (for example, creating ClusterPolicies) by controlling the urlPath through context variable substitution. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22039

CVE-2026-22039:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kyverno/kyverno	go	< 1.15.3	1.15.3
github.com/kyverno/kyverno	go	>= 1.16.0-rc.1, < 1.16.3	1.16.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in Kyverno's apiCall feature, allowing a user with limited permissions to create a namespaced policy that can make arbitrary API calls with the Kyverno admission controller's elevated privileges. The root cause is the lack of validation on the urlPath field within an apiCall definition in a namespaced policy.

The analysis of the provided patches (e.g., e0ba4de4f1e0ca325066d5095db51aec45b1407b) confirms this. The primary vulnerable function is apiCall.Fetch in pkg/engine/apicall/apiCall.go. In the vulnerable versions, this function performs variable substitution on the urlPath and passes it to the executor without checking if the resulting path targets resources outside the policy's namespace. The patch introduces a regex-based check within apiCall.Fetch to ensure that for namespaced policies, the API path is restricted to the policy's own namespace.

A second key function, executor.executeK8sAPICall in pkg/engine/apicall/executor.go, is identified from the vulnerability description. While not patched directly, this function is a critical part of the exploit chain as it receives the tainted path and executes the raw API request. Any runtime profile of an exploit would likely show this function making the unauthorized call to the Kubernetes API server.

Vulnerable functions

apiCall.Fetch

pkg/engine/apicall/apiCall.go

This function is responsible for processing `apiCall` context entries. In the vulnerable version, it performs variable substitution on the `urlPath` from a policy but fails to validate that the resulting path is confined to the policy's namespace. This allows an attacker to craft a path to access or modify resources across namespaces or at the cluster level, leading to privilege escalation.

executor.executeK8sAPICall

pkg/engine/apicall/executor.go

This function executes the raw Kubernetes API request. It receives the malicious, user-controlled `path` after variable substitution in `apiCall.Fetch` and directly uses it to make an API call via `a.client.RawAbsPath`. As this function is where the actual unauthorized request is made, it would be a key indicator in a runtime trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.