CVE-2026-124440: Authorization bypass in Kyverno 1.19.1

CVE-2026-124440 describes an authorization bypass vulnerability in Kyverno, the policy engine for Kubernetes, affecting version 1.19.1. The flaw resides in the apiCall namespace clamp mechanism: through malformed percent-escape sequences, attackers can bypass authorization controls and execute cross-namespace and cluster-scoped API requests. This directly impacts organizations managing Kubernetes clusters with Kyverno as their security policy enforcement tool.

The vulnerability has a CVSS score of 9.9, the highest severity rating. The status is critical: a patch exists (version 1.19.2) and was published on 2026-11-08. In the Kubernetes context, this flaw is particularly severe because it exploits the admission-controller ServiceAccount, which holds broad permissions to read and modify cluster-wide resources. Initial signals on X show awareness of the vulnerability, with 2 posts in the last 24 hours flagging the severity and patch availability.

The defensive response is immediate: verify the Kyverno version in production and upgrade to 1.19.2 if running 1.19.1. Disable apiCall-based Policies temporarily if possible. Monitor admission-controller logs for anomalous cross-namespace requests and webhook creation, especially from limited-access users. Audit existing Policies to identify those using apiCall and apply mitigations until patching is complete.