CVE-2026-84200Critical· 9.0▾ MidnightKyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the po…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., 'ingress'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/kyverno/kyverno >= 1.9.0, < 1.13.0Patched in:
github.com/kyverno/kyverno 1.13.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-29778Medium· 5.8Kyverno ignores subjectRegExp and IssuerRegExp
CVE-2023-33191Medium· 4.6kyverno seccomp control can be circumvented
CVE-2026-84196High· 7.7Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution
CVE-2026-84195High· 7.7Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers
CVE-2025-15613Medium· 6.5Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality
CVE-2023-34091Medium· 6.5Kyverno resource with a deletionTimestamp may allow policy circumvention