CVE-2026-41068
Fixed in a distro release EPSS <1%CVSS 7.7
Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.
Products: kyverno
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kyverno/kyverno | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-kyverno-1.13 | no fix |
| Chainguard | commercial-kyverno-1.14 | no fix |
| Chainguard | commercial-kyverno-1.15 | no fix |
| Chainguard | commercial-kyverno-1.16 | no fix |
| Chainguard | commercial-kyverno-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-background-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-reports-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyvernopre-1.13 | no fix |
| Chainguard | commercial-kyvernopre-1.14 | no fix |
| Chainguard | commercial-kyvernopre-1.15 | no fix |
| Chainguard | commercial-kyvernopre-1.16 | no fix |
| Chainguard | commercial-kyvernopre-1.17 | 1.17.2-r0 |
| Chainguard | kyverno-1.13 | no fix |
| Chainguard | kyverno-1.14 | no fix |
| Chainguard | kyverno-1.15 | no fix |
| Chainguard | kyverno-1.16 | no fix |
| Chainguard | kyverno-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-background-controller-1.13 | no fix |
| Chainguard | kyverno-background-controller-1.14 | no fix |
| Chainguard | kyverno-background-controller-1.15 | no fix |
| Chainguard | kyverno-background-controller-1.16 | no fix |
| Chainguard | kyverno-background-controller-1.18 | 1.18.1-r10 |
| Chainguard | kyverno-background-controller-fips-1.13 | no fix |
| Chainguard | kyverno-background-controller-fips-1.14 | no fix |
| Chainguard | kyverno-background-controller-fips-1.15 | no fix |
| Chainguard | kyverno-background-controller-fips-1.16 | no fix |
| Chainguard | kyverno-background-controller-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-background-controller-fips-1.18 | 1.18.1-r5 |
| Chainguard | kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | kyverno-cleanup-controller-1.18 | 1.18.1-r11 |
| Chainguard | kyverno-cleanup-controller-fips-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-cleanup-controller-fips-1.18 | 1.18.1-r5 |
| Chainguard | kyverno-cli-1.13 | no fix |
| Chainguard | kyverno-cli-1.14 | no fix |
| Chainguard | kyverno-cli-1.15 | no fix |
| Chainguard | kyverno-cli-1.16 | no fix |
| Chainguard | kyverno-cli-1.18 | 1.18.1-r11 |
| Chainguard | kyverno-cli-1.18 | 1.18.1-r10 |
| Chainguard | kyverno-cli-fips-1.13 | no fix |
| Chainguard | kyverno-cli-fips-1.14 | no fix |
| Chainguard | kyverno-cli-fips-1.15 | no fix |
| Chainguard | kyverno-cli-fips-1.16 | no fix |
| Chainguard | kyverno-cli-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-cli-fips-1.18 | 1.18.1-r5 |
| Chainguard | kyverno-fips-1.13 | no fix |
| Chainguard | kyverno-fips-1.14 | no fix |
| Chainguard | kyverno-fips-1.15 | no fix |
| Chainguard | kyverno-fips-1.16 | no fix |
| Chainguard | kyverno-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-fips-1.18 | 1.18.1-r5 |
| Chainguard | kyverno-init-container-1.13 | no fix |
| Chainguard | kyverno-init-container-1.14 | no fix |
| Chainguard | kyverno-init-container-1.15 | no fix |
| Chainguard | kyverno-init-container-1.16 | no fix |
| Chainguard | kyverno-init-container-1.18 | 1.18.1-r11 |
| Chainguard | kyverno-init-container-1.18 | 1.18.2-r15 |
| Chainguard | kyverno-init-container-fips-1.13 | no fix |
| Chainguard | kyverno-init-container-fips-1.14 | no fix |
| Chainguard | kyverno-init-container-fips-1.15 | no fix |
| Chainguard | kyverno-init-container-fips-1.16 | no fix |
| Chainguard | kyverno-init-container-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-init-container-fips-1.18 | 1.18.1-r5 |
| Chainguard | kyverno-notation-aws | 1.1-r52 |
| Chainguard | kyverno-notation-aws-fips | 1.1-r46 |
| Chainguard | kyverno-readiness-checker-1.18 | 1.18.1-r11 |
| Chainguard | kyverno-readiness-checker-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-readiness-checker-fips-1.18 | 1.18.1-r5 |
| Chainguard | kyverno-reports-controller-1.13 | no fix |
| Chainguard | kyverno-reports-controller-1.14 | no fix |
| Chainguard | kyverno-reports-controller-1.15 | no fix |
| Chainguard | kyverno-reports-controller-1.16 | no fix |
| Chainguard | kyverno-reports-controller-1.18 | 1.18.1-r11 |
| Chainguard | kyverno-reports-controller-fips-1.13 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.14 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.15 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.16 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.17 | 1.17.2-r12 |
| Chainguard | kyverno-reports-controller-fips-1.18 | 1.18.1-r5 |
| Chainguard | reports-server | no fix |
| Wolfi | kyverno-1.16 | no fix |
| Wolfi | kyverno-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-background-controller-1.16 | no fix |
| Wolfi | kyverno-background-controller-1.18 | 1.18.1-r10 |
| Wolfi | kyverno-cleanup-controller-1.16 | no fix |
| Wolfi | kyverno-cleanup-controller-1.18 | 1.18.1-r11 |
| Wolfi | kyverno-cli-1.16 | no fix |
| Wolfi | kyverno-cli-1.18 | 1.18.1-r10 |
| Wolfi | kyverno-cli-1.18 | 1.18.1-r11 |
| Wolfi | kyverno-init-container-1.16 | no fix |
| Wolfi | kyverno-init-container-1.18 | 1.18.2-r15 |
| Wolfi | kyverno-init-container-1.18 | 1.18.1-r11 |
| Wolfi | kyverno-notation-aws | 1.1-r52 |
| Wolfi | kyverno-readiness-checker-1.18 | 1.18.1-r11 |
| Wolfi | kyverno-reports-controller-1.16 | no fix |
| Wolfi | kyverno-reports-controller-1.18 | 1.18.1-r11 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |