Security readout for executives and security teams
Plain-English summary
Kyverno clusters may allow a lower-privileged user who can create a namespaced Policy to make Kyverno act with its more powerful admission controller identity. This can break namespace isolation and may expose or change resources outside the user’s namespace. The issue is fixed in Kyverno 1.15.3 and 1.16.3.
Executive priority
Treat as urgent for Kyverno-managed Kubernetes environments. The vulnerability can turn limited namespace policy permissions into broader cluster access, depending on RBAC. Prioritize upgrade and access review, especially in shared, multi-tenant, or regulated clusters.
Technical view
CVE-2026-22039 is an authorization boundary bypass in namespaced Kyverno Policy apiCall handling. Before 1.15.3 and 1.16.3, the resolved urlPath could target API paths outside the policy namespace and execute as the Kyverno admission controller ServiceAccount. Impact depends on that ServiceAccount’s Kubernetes RBAC permissions.
Likely exposure
Exposure is likely in Kubernetes clusters running Kyverno versions below 1.15.3, or 1.16.0 through 1.16.2, where users can create namespaced Kyverno Policy resources. Risk is higher when Kyverno’s admission controller ServiceAccount has broad read or write RBAC permissions.
Exploitation context
The advisory describes exploitation by any authenticated user with permission to create a namespaced Policy. Sources do not state active exploitation, and the CVE is not marked KEV in the provided bundle. No public exploit status beyond the advisory details is provided.
Researcher notes
Key mechanics are namespace trust boundary failure and server-side request execution through Kyverno’s admission controller identity. The impact is RBAC-dependent: cross-namespace reads and cluster-scoped or cross-namespace writes are possible where the ServiceAccount allows them. Patch commits are referenced, but this assessment does not infer unlisted variants.
Mitigation direction
- Upgrade Kyverno to 1.15.3 or 1.16.3, as applicable.
- Review vendor advisory and release guidance before deployment.
- Restrict who can create namespaced Kyverno Policy resources.
- Review Kyverno admission controller ServiceAccount RBAC for least privilege.
- Monitor for unusual Policy apiCall usage and cross-namespace API access.
Validation and detection
- Inventory Kyverno versions across all Kubernetes clusters.
- Identify clusters running versions below 1.15.3 or 1.16.0 through 1.16.2.
- List users and roles allowed to create namespaced Policy resources.
- Review Kyverno admission controller ServiceAccount permissions.
- Check audit logs for Policy apiCall activity targeting outside the policy namespace.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22039 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kyverno/kyverno/security/advisories/GHSA-8p9x-46gm-qfx2CVE reference · x_refsource_CONFIRM
- https://github.com/kyverno/kyverno/commit/e0ba4de4f1e0ca325066d5095db51aec45b1407bCVE reference · x_refsource_MISC
- https://github.com/kyverno/kyverno/commit/eba60fa856c781bcb9c3be066061a3df03ae4e3eCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.