CVE-2026-41068: Kyverno

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.

Affected products

• Kyverno Kyverno: before 1.17.2 (fixed in 1.17.2)

Published 2026-04-24. Last modified 2026-06-17.