EUVD-2026-69035
GHSA-q8fv-357q-9mmj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Abuse occurs via the Kubernetes API (AV:N) by an authenticated low-privileged user (PR:L); requires pre-existing overlapping exceptions (AC:H); bypassing hostPath controls enables node compromise, a scope change (S:C) with high C/I/A.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.
AnalysisAI
Policy enforcement bypass in Kyverno v1.9.0 through v1.12.7 lets an authenticated Kubernetes user evade an enforce-mode ClusterPolicy when two overlapping PolicyExceptions apply to the same rule, because the less-restrictive exception wins. An attacker who can name a workload to match a permissive exception pattern (for example '*ingress*') can deploy resources the policy was meant to block, such as Pods with hostPath volumes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target cluster already have (1) a Kyverno policy in enforce mode (validationFailureAction: Enforce) and (2) at least two PolicyExceptions referencing the same policy and rule, where one exception matches on a permissive selector such as resource-name globs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine control-plane security-guardrail failure rather than a memory-safety RCE, and its severity depends heavily on cluster configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: upgrade Kyverno to v1.13.0 or later (Vendor-released patch: v1.13.0), per GHSA-gg4x-fgg2-h9w9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kyverno deployments and confirm whether versions 1.9.0 through 1.12.7 are running; for affected instances, audit all ClusterPolicy and PolicyException configurations to map overlapping rules and permissive naming patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy
Kyverno is a policy engine designed for Kubernetes. Rated high severity (CVSS 8.7), this vulnerability is remotely explo
Kyverno is a policy engine designed for cloud native platform engineering teams. Rated high severity (CVSS 8.5), this vu
Kyverno versions up to 1.16.3 is affected by allocation of resources without limits or throttling (CVSS 7.7).
Kyverno is a policy engine designed for cloud native platform engineering teams. Rated medium severity (CVSS 5.8), this
Kyverno versions 1.16.0 and later contain a server-side request forgery vulnerability in unrestricted CEL HTTP functions
Kyverno is a policy engine designed for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
Credential leakage in Kyverno's apiCall service mode automatically forwards the Kubernetes admission controller's Servic
Server-side request forgery in Kyverno's Kubernetes admission controller (all versions before 1.18.0) enables any authen
Kyverno's apiCall feature automatically attaches the admission controller's ServiceAccount token to HTTP requests withou
An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a ma
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today