Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyve…

Kyverno policy engine for Kubernetes contains a vulnerability in its ConfigMap context loader that allows complete RBAC bypass. The configMap.namespace field accepts any namespace without validation, enabling namespace admins to read ConfigMaps from any namespace using Kyverno's privileged service account. This represents a cross-namespace privilege escalation similar to the previously patched CVE-2026-22039. The vulnerability particularly impacts multi-tenant Kubernetes clusters where namespace isolation is critical for security. A fix is available in version 1.17.2 of Kyverno.