CVE-2026-22039 – Kyverno

Kyverno has released a critical security patch addressing CVE-2026-22039, a severe vulnerability impacting its policy enforcement mechanisms. This issue could allow attackers to bypass admission controls, undermining Kubernetes security policies and exposing clusters to unauthorized workloads or configuration changes. The CVSS score is 10.0, which is Critical severity.

Proof-of-concept code is publicly available, confirming that exploitation is feasible. This significantly raises the risk for organizations relying on Kyverno for policy governance, as attackers can weaponize this weakness to evade controls and deploy malicious resources.