{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "kyverno: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/kyverno--kyverno/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/kyverno--kyverno/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100707/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100707/",
   "title": "CVE-2026-100707 disclosed",
   "content_text": "Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.",
   "date_published": "2026-09-26T13:24:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100706/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100706/",
   "title": "CVE-2026-100706 disclosed",
   "content_text": "kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.",
   "date_published": "2026-09-26T13:24:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100705/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100705/",
   "title": "CVE-2026-100705 disclosed",
   "content_text": "Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API path, which handle every non-CEL context[].apiCall.service call. Because these paths use a plain net/http client with no egress filtering and no validation of the configured service URL, a ClusterPolicy or GlobalContextEntry author — or, where a deployed policy templates the service URL from the admission resource, a lower-privileged resource submitter — can cause Kyverno to issue GET/POST requests to an arbitrary host, including the cloud metadata endpoint, loopback, and any in-cluster service, reading cloud instance credentials and reaching internal endpoints with Kyverno's network position. The executor also unconditionally attaches Kyverno's projected ServiceAccount token to the attacker-chosen destination; the token is audience-scoped, limiting its replay value. Fixed in 1.19.1.",
   "date_published": "2026-09-26T13:23:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100704/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100704/",
   "title": "CVE-2026-100704 disclosed",
   "content_text": "Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource rather than only for the listed images or values, so an exception intended to exempt a single trusted image exempts every image on the matched resource(s). As a result, unsigned or untrusted images can be admitted to the cluster without signature verification. This differs from ValidatingPolicy, GeneratingPolicy, and MutatingPolicy, which treat the same field as a partial exemption. The issue is fixed in version 1.19.1.",
   "date_published": "2026-09-26T13:23:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100703/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100703/",
   "title": "CVE-2026-100703 disclosed",
   "content_text": "Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedValidatingPolicy, and likewise the namespaced mutating, deleting, generating, and image-validating policy kinds) in their own namespace can call globalContext.get(\"\u003centry\u003e\", \"\") and receive the full cached contents of a cluster-scoped GlobalContextEntry, including data cached from namespaces the tenant has no RBAC permission to read. No admission validation rejects such calls. Fixed in 1.19.1.",
   "date_published": "2026-09-26T13:23:58Z"
  }
 ]
}