CVE-2026-100703: Kyverno Information Disclosure Vulnerability

CVE-2026-100703 Overview

CVE-2026-100703 is an information disclosure vulnerability in Kyverno, a policy engine for Kubernetes. Versions 1.16.0 through 1.19.0 register the globalcontext.Lib Common Expression Language (CEL) library in the policy environment without scoping it to the policy's namespace. Sibling libraries such as resource.Lib, http.Lib, and the configMap loader are correctly handed the policy namespace. The gap allows a tenant with permission to create a namespaced policy to invoke globalContext.get("<entry>", "") and retrieve the full cached contents of a cluster-scoped GlobalContextEntry. The returned data can include resources from namespaces the tenant has no role-based access control (RBAC) rights to read. The issue is fixed in Kyverno 1.19.1 and classified as CWE-200.

Critical Impact
A low-privilege tenant with namespaced policy creation rights can read cross-namespace data cached in Kyverno's global context, bypassing Kubernetes RBAC isolation.

Affected Products

Kyverno 1.16.0 through 1.19.0
NamespacedValidatingPolicy and sibling namespaced mutating, deleting, generating, and image-validating policy kinds
Multi-tenant Kubernetes clusters relying on Kyverno GlobalContextEntry caching

Discovery Timeline

2026-09-26 - CVE-2026-100703 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in the NVD database

Technical Details for CVE-2026-100703

Vulnerability Analysis

Kyverno exposes several CEL libraries to policy authors for use in validation and mutation expressions. The resource.Lib, http.Lib, and configMap loader receive the enclosing policy's namespace, which the runtime uses to confine queries and prevent cross-tenant access. The globalcontext.Lib library was registered in the same policy environment but was never bound to the namespace of the policy that invoked it.

GlobalContextEntry objects are cluster-scoped and can cache arbitrary Kubernetes resources from any namespace an administrator configures them to watch. When a tenant creates a NamespacedValidatingPolicy and calls globalContext.get("<entry>", ""), Kyverno returns the entire cached payload. Admission validation does not reject the call, so the tenant obtains data that RBAC would otherwise deny. CEL expressions can then exfiltrate the content through policy audit messages or by shaping validation decisions on observed values.

Root Cause

The root cause is a missing namespace confinement at library registration. Where sibling libraries wrap the policy namespace into their constructor, globalcontext.Lib was registered globally. The admission controller never post-filters results against the caller's namespace, so a privilege boundary that exists in Kubernetes RBAC is absent inside the CEL evaluation path.

Attack Vector

Exploitation requires a tenant account with permission to create one of the namespaced Kyverno policy kinds in a namespace it already controls. No cluster-admin rights, no network pivot, and no user interaction are needed. The attacker authors a policy whose CEL expression calls globalContext.get() against a known entry name and emits the retrieved object through a validation warning, deny message, or generated resource field. Entry names are discoverable from cluster documentation or by iterating candidate strings.

See the GitHub Security Advisory GHSA-59v6-2x73-wfg4 and the VulnCheck Advisory for Kyverno for the maintainer analysis.

Detection Methods for CVE-2026-100703

Indicators of Compromise

Namespaced Kyverno policies (NamespacedValidatingPolicy, NamespacedMutatingPolicy, NamespacedDeletingPolicy, NamespacedGeneratingPolicy, NamespacedImageValidatingPolicy) authored by non-admin service accounts that reference globalContext.get in CEL expressions.
Kyverno admission or audit logs showing globalContext.get("<entry>", "") invocations originating from tenant namespaces.
Validation deny or warning messages containing serialized resource data from namespaces unrelated to the policy's own namespace.

Detection Strategies

Inventory all GlobalContextEntry objects and map which namespaces they cache; treat any CEL reference to them from tenant-owned policies as suspicious.
Parse Kyverno controller logs for the globalcontext library invocation path and correlate the caller's namespace against the data returned.
Run periodic policy linting across the cluster to flag any namespaced policy whose expression tree includes globalContext.

Monitoring Recommendations

Alert on creation or update of namespaced Kyverno policy kinds by non-platform identities.
Capture Kubernetes audit events for create and update on Kyverno policy CRDs and ship them to a central data lake for retention and query.
Baseline Kyverno controller resource usage so that anomalous spikes in global-context reads trigger review.

How to Mitigate CVE-2026-100703

Immediate Actions Required

Upgrade Kyverno to version 1.19.1 or later on every cluster running 1.16.0 through 1.19.0.
Audit existing namespaced policies for references to globalContext.get and remove or rewrite any that were not authored by the platform team.
Review GlobalContextEntry definitions and remove entries that cache sensitive cross-tenant data unless strictly required.

Patch Information

The maintainers fixed the issue in Kyverno 1.19.1 by confining the globalcontext.Lib CEL library to the policy's namespace, matching the behavior of the sibling libraries. Release notes and patch details are documented in GitHub Security Advisory GHSA-59v6-2x73-wfg4.

Workarounds

Restrict RBAC so that tenants cannot create namespaced Kyverno policy kinds until the upgrade is complete.
Delete or scope down GlobalContextEntry resources that mirror data from namespaces subject to tenant isolation.
Use a Kubernetes admission policy (for example, a Kyverno ClusterPolicy authored by platform operators) to deny tenant-created policies whose CEL text contains globalContext.

bash

# Configuration example
kubectl get namespacedvalidatingpolicies.kyverno.io -A \
  -o json | jq '.items[] | select(.spec.validations[]?.expression | test("globalContext"))'