---
id: CVE-2026-122311
title: >-
  Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via
  resource argument
summary: >-
  Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the
  resource argument of resource.get() and resource.post(), allowing namespaced
  CEL policies to escape their namespace. Tenants who can create a
  NamespacedValidatingPo…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: kyverno
product: kyverno
affected:
  - kyverno >= 1.16.0 < 1.19.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:25:13.645Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122311'
references:
  - url: 'https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2'
    label: GitHub Security Advisory (GHSA-4pqm-wqq6-h9q2)
  - url: >-
      https://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument
    label: >-
      VulnCheck Advisory: Kyverno 1.16.0 before 1.19.2 Path Traversal in
      Namespaced CEL Policies via resource argument
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.685Z'
epss: 0.00448
epssPercentile: 0.39158
---

## Overview

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

## Affected

- `kyverno >= 1.16.0 < 1.19.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.