Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-100706
By Roy Kalfon |
27 September 2026
CVE-2026-100706 – Kyverno apiCall urlPath encoding bypass enables cross-namespace object creation and cluster-admin escalation
kyverno before 1.19.1 mishandles URL-encoded path segments in Policy apiCall urlPath, letting namespace tenants bypass per-namespace clamping via percent-encoded directory traversal. Attackers can create objects in other namespaces as the admission-controller ServiceAccount, including cluster-wide MutatingWebhookConfiguration or PolicyException in the kyverno namespace, escalating to cluster admin. Upgrade to 1.19.1 to mitigate.