CVE-2026-100707 Overview
Kyverno versions before 1.19.1 contain a namespace isolation bypass in the apiCall context entry of namespaced Policy resources. The flaw stems from inconsistent path interpretation between the validation layer and the execution layer. A low-privilege tenant can submit percent-encoded dot-segments inside the urlPath field to evade namespace scope checks. The admission controller then resolves the request using its own ServiceAccount credentials, which hold cluster-wide read access. This allows a tenant confined to one namespace to read resources from any other namespace in the cluster. The weakness is tracked as a path traversal issue [CWE-22].
Critical Impact
Low-privilege tenants in multi-tenant Kubernetes clusters can read secrets, configmaps, and other resources from namespaces they do not control.
Affected Products
- Kyverno versions prior to 1.19.1
- Multi-tenant Kubernetes clusters using namespaced Kyverno Policy resources
- Deployments relying on Kyverno apiCall context entries for policy decisions
Discovery Timeline
- 2026-09-26 - CVE-2026-100707 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100707
Vulnerability Analysis
Kyverno is a policy engine for Kubernetes that supports fetching external data through the apiCall context entry inside Policy and ClusterPolicy resources. For namespaced Policy resources, Kyverno restricts urlPath values so they only reference objects inside the tenant's namespace. The validator performs this check against the literal string provided by the user.
The execution layer, however, normalizes the path before issuing the Kubernetes API request. Percent-encoded sequences such as %2E%2E%2F are decoded during execution but ignored during validation. The two components therefore disagree about which namespace the request targets.
Because the admission controller executes the final request using its own ServiceAccount, which typically has cluster-wide read permissions, the resolved request succeeds against any namespace. A tenant can read Secrets, ConfigMaps, and other API objects outside their assigned namespace, breaking the trust boundary that multi-tenant clusters depend on.
Root Cause
The root cause is inconsistent path interpretation between two code paths that operate on the same input. The validator treats urlPath as an opaque string, while the HTTP client decodes percent-encoded characters before building the request URL. This parser-differential pattern maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
An attacker needs permission to create or modify a namespaced Kyverno Policy inside their own tenant namespace. The attacker crafts an apiCall entry whose urlPath contains percent-encoded dot-segments that resolve, after decoding, to a path in another namespace such as kube-system. When Kyverno evaluates the policy, the admission controller fetches the targeted resource and returns its contents through policy evaluation outputs or logs. No workloads outside the tenant namespace need to be compromised.
The vulnerability mechanism and reproduction details are documented in the GitHub Security Advisory GHSA-c5qq-7g2q-cpqp and the VulnCheck Advisory on Kyverno Bypass.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-100707
Indicators of Compromise
- Namespaced Kyverno Policy or ClusterPolicy resources containing apiCall entries where urlPath includes percent-encoded sequences such as %2E, %2F, or %2E%2E.
- Kyverno admission controller audit logs showing API reads against namespaces that do not match the Policy's own namespace.
- Unusual access patterns from the Kyverno ServiceAccount targeting Secrets or ConfigMaps outside typical policy scope.
Detection Strategies
- Parse all namespaced Policy resources and flag any apiCall.urlPath value that contains % characters or non-literal path segments.
- Correlate Kubernetes API server audit logs with Kyverno Policy namespaces to identify cross-namespace reads performed by the Kyverno ServiceAccount.
- Alert on Policy creation events from low-privilege ServiceAccounts that define new apiCall context entries.
Monitoring Recommendations
- Enable Kubernetes API server audit logging at the Metadata level or higher for Secret and ConfigMap reads.
- Forward Kyverno controller logs to a centralized log store and retain for incident review.
- Baseline the Kyverno ServiceAccount's normal access patterns to detect deviations after policy changes.
How to Mitigate CVE-2026-100707
Immediate Actions Required
- Upgrade Kyverno to version 1.19.1 or later across all clusters.
- Audit existing namespaced Policy resources for apiCall entries containing percent-encoded characters in urlPath.
- Rotate any Secrets in sensitive namespaces that may have been exposed to tenant users with Policy creation rights.
- Restrict kyverno.io/v1 Policy write permissions to trusted service accounts where feasible.
Patch Information
Kyverno 1.19.1 corrects the inconsistency by normalizing urlPath before validation, so both the validator and the HTTP client operate on the same canonical string. Review the GitHub Security Advisory GHSA-c5qq-7g2q-cpqp for the complete fix details and upgrade guidance.
Workarounds
- Use Kubernetes RBAC to prevent tenants from creating or modifying Kyverno Policy resources until the upgrade is complete.
- Deploy an admission webhook that rejects Kyverno Policies whose apiCall.urlPath fields contain % characters.
- Reduce the Kyverno admission controller's ClusterRole to the minimum set of resources required by in-use policies.
# Configuration example: Helm upgrade to the patched release
helm repo update
helm upgrade kyverno kyverno/kyverno \
--namespace kyverno \
--version 1.19.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
