CVE-2026-100706: Kyverno Privilege Escalation Vulnerability

CVE-2026-100706 Overview

Kyverno versions before 1.19.1 contain a privilege escalation vulnerability in Policy apiCallurlPath validation. The admission controller fails to properly validate URL-encoded path segments, allowing namespace tenants to bypass the per-namespace clamp. Attackers with namespace-level access can create objects in other namespaces using the admission-controller ServiceAccount identity. The flaw enables creation of cluster-wide MutatingWebhookConfiguration objects or PolicyException objects in the kyverno namespace, resulting in full cluster admin privilege escalation.

Critical Impact
A namespace tenant can escalate to cluster admin by abusing percent-encoded directory traversal in Policy apiCallurlPath fields, pivoting through the Kyverno admission controller ServiceAccount.

Affected Products

Kyverno versions prior to 1.19.1
Kubernetes clusters running Kyverno with multi-tenant namespace delegation
Deployments permitting namespace users to create Policy resources

Discovery Timeline

2026-09-26 - CVE-2026-100706 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100706

Vulnerability Analysis

Kyverno's Policy resource supports an apiCall context entry that lets policies query the Kubernetes API server. For namespaced Policy objects, Kyverno is designed to clamp the urlPath to the owning namespace, preventing tenants from reaching cluster-scoped resources or other namespaces. The validation logic parses the raw urlPath string without first decoding percent-encoded segments. An attacker who crafts a URL containing encoded traversal sequences slips past the clamp check, after which the API server decodes the path and executes the request. The resulting call runs under the Kyverno admission-controller ServiceAccount, which holds broad cluster privileges. This mismatch between validator and consumer path parsing [CWE-441] produces a confused-deputy condition that converts a limited namespace user into cluster admin.

Root Cause

The root cause is inconsistent URL path normalization between Kyverno's namespace-scope validator and the downstream HTTP client. Kyverno trusts the literal urlPath string during validation, while the Kubernetes API server decodes percent-encoded sequences such as %2F before routing. Validation and execution operate on different representations of the same input.

Attack Vector

An attacker with permission to create Policy resources in any namespace authors a policy whose apiCall.urlPath embeds encoded traversal (for example, encoded slashes and .. segments) targeting cluster-scoped endpoints. When Kyverno evaluates the policy, the admission-controller ServiceAccount issues the request and creates a MutatingWebhookConfiguration cluster-wide, or a PolicyException in the kyverno namespace. The mutating webhook can then intercept and modify arbitrary cluster resources, yielding cluster admin control.

See the GitHub Security Advisory GHSA-5qq8-67g6-4h2w and the VulnCheck Advisory on Kyverno Privilege Escalation for technical specifics.

Detection Methods for CVE-2026-100706

Indicators of Compromise

Creation of MutatingWebhookConfiguration or ValidatingWebhookConfiguration objects by the Kyverno admission-controller ServiceAccount outside of normal install or upgrade windows.
PolicyException objects appearing in the kyverno namespace that were not authored by cluster administrators.
Policy resources containing apiCall.urlPath values with percent-encoded characters such as %2F, %2E, or %252F.
Kubernetes audit log entries showing the Kyverno ServiceAccount performing cross-namespace writes.

Detection Strategies

Enable Kubernetes audit logging and alert on write operations by the Kyverno ServiceAccount targeting resources outside the Kyverno namespace.
Inspect all Policy and ClusterPolicy objects for apiCall context entries whose urlPath contains percent-encoded sequences.
Correlate MutatingWebhookConfiguration create events against the identity and timing of recent Policy submissions.

Monitoring Recommendations

Baseline the expected set of webhook configurations and alert on any additions.
Track Policy creation events per namespace and flag tenants submitting policies that reference cluster-scoped API paths.
Forward Kubernetes audit logs to a centralized analytics platform to retain searchable history of ServiceAccount activity.

How to Mitigate CVE-2026-100706

Immediate Actions Required

Upgrade Kyverno to version 1.19.1 or later across all clusters.
Audit existing Policy, ClusterPolicy, PolicyException, and webhook objects for signs of exploitation before and after upgrade.
Rotate credentials and review RBAC bindings tied to the Kyverno admission-controller ServiceAccount if compromise is suspected.

Patch Information

The fix is included in Kyverno 1.19.1. The patch adds URL decoding to the urlPath validator so the namespace clamp evaluates the same path the API server will execute. Refer to the GitHub Security Advisory GHSA-5qq8-67g6-4h2w for release details.

Workarounds

Restrict Policy creation permissions to trusted administrators until the upgrade completes.
Apply an admission policy or OPA/Gatekeeper rule that rejects Policy resources containing percent-encoded characters in apiCall.urlPath.
Tighten RBAC on the Kyverno admission-controller ServiceAccount to the minimum required verbs and resources.

bash

# Verify installed Kyverno version and upgrade via Helm
kubectl get deployment -n kyverno kyverno-admission-controller \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

helm repo update
helm upgrade kyverno kyverno/kyverno \
  --namespace kyverno \
  --version 1.19.1

# Audit policies for suspicious encoded urlPath values
kubectl get policies.kyverno.io,clusterpolicies.kyverno.io -A -o json \
  | grep -E '%2[Ff]|%2[Ee]|%25'