Kyverno Privilege Escalation: RBAC Bypass in Multi-Tenant Clusters

The National Vulnerability Database has disclosed CVE-2026-41068, a high-severity privilege escalation vulnerability in Kyverno, a policy engine for cloud-native platforms. Rated 7.7 CVSS, this flaw allows a namespace administrator to bypass Kubernetes RBAC and read ConfigMaps from any namespace. This is a critical issue for multi-tenant Kubernetes environments.

The vulnerability stems from insufficient validation in Kyverno’s configMap.namespace field within its ConfigMap context loader. While a previous patch (CVE-2026-22039) addressed a similar issue in the apiCall context by validating URLPath, the ConfigMap context was overlooked. This allows an attacker to leverage Kyverno’s privileged service account to achieve a complete RBAC bypass.

For defenders, this means an attacker with namespace admin privileges can escalate to gain unauthorized access to sensitive configurations across the cluster. The National Vulnerability Database confirms a fix is available in Kyverno version 1.17.2. Organizations running Kyverno in multi-tenant Kubernetes clusters must prioritize this update.