Kyverno EUVD-2026-69035

Exploitation requires that the target cluster already have (1) a Kyverno policy in enforce mode (validationFailureAction: Enforce) and (2) at least two PolicyExceptions referencing the same policy and rule, where one exception matches on a permissive selector such as resource-name globs. The attacker must hold Kubernetes API permissions to create the target workload kind (Pod, Deployment, DaemonSet, etc.) in a namespace/scope reachable by the permissive exception, and must be able to name the resource to match that exception's pattern (e.g. containing 'ingress' or 'haproxy'). Limiting factors: clusters using at most one PolicyException per rule are not affected; the bypass only reaches the impact class permitted by the bypassed policy (here, hostPath and thus node access); and per the vendor CVSS the vector is scored as adjacent (AV:A) with low-privilege authentication (PR:L), so unauthenticated remote abuse is not indicated.

This is a genuine control-plane security-guardrail failure rather than a memory-safety RCE, and its severity depends heavily on cluster configuration. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N with high vulnerable- and subsequent-system impact, score 9.4) reflects the downstream consequence - bypassing hostPath restrictions can lead to node access and container escape - but two of its metrics are debatable: AV:A (adjacent) is unusual for an abuse that occurs through the Kubernetes API server (more naturally AV:N), and the score treats impact as unconditional even though exploitation requires that two overlapping PolicyExceptions already exist for the same rule. No EPSS score, KEV entry, or independent exploit-maturity signal was provided, so probability of opportunistic mass exploitation is unquantified and likely low; the realistic threat is an insider or a compromised low-privileged tenant deliberately abusing a known-misconfigured cluster. Organizations relying on Kyverno as their sole Pod Security enforcement layer should treat this as urgent, because a silent policy bypass undermines the assumption that enforce mode is authoritative, while clusters that do not use multiple PolicyExceptions per rule are effectively unaffected.

A low-privileged tenant in a shared cluster discovers that a 'disallow-host-path' enforce policy has two PolicyExceptions, one of which exempts resources whose names match '*ingress*'. The tenant deploys a Pod named to match that pattern with a hostPath volume mounting the node filesystem, which Kyverno admits despite the enforce policy, giving a foothold for node-level privilege escalation. The vendor advisory publishes the exact manifests needed to reproduce this.