ZeroDay Findings
Sign inSign up

Findings

CVE-2026-41068

Kyverno is a policy engine designed for cloud native platform engineering teams.

Published Apr 24, 2026 · updated Jun 17, 2026 · kyverno kyverno

Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's context by validating the field. However, the ConfigMap context loader has the identical vulnerability — the field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2026 · NIST NVD

    Detected

    Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's context by validating the field. However, the ConfigMap context loader has the identical vulnerability — the field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyve

  2. Jun 17, 2026 · NIST NVD

    Updated

    Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's context by validating the field. However, the ConfigMap context loader has the identical vulnerability — the field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyve

Affected

  • cpe kyverno/kyvernoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-41068

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-41068

    Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's context by validating the field. However, the ConfigMap context loader has the identical vulne

    nvd.nist.gov

References