CVE-2026-84200

CVE-2026-84200 is a policy enforcement bypass (CWE-284) in Kyverno, the Kubernetes admission-control policy engine, affecting versions v1.9.0 through v1.12.7. When an enforce-mode policy coexists with two PolicyExceptions, the less restrictive exception takes precedence, so an attacker who controls resource naming can craft a name matching the broader wildcard pattern of a second exception (e.g., '*ingress*') and escape the policy. This allows a low-privileged workload to violate controls such as a rule blocking hostPath volumes, undermining the cluster security guarantees operators rely on Kyverno to enforce. Any cluster running an affected Kyverno version with multiple PolicyExceptions defined is exposed, and the flaw is rated critical (CVSS 4.0: 9.4). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to Kyverno v1.13.0 or later. Until patched, audit existing PolicyExceptions for overlapping or overly broad name patterns, restrict who can create PolicyExceptions, and check whether enforce-mode policies (e.g., hostPath restrictions) could be evaded by resource names matching another exception's wildcard. Cluster administrators with multiple exceptions on the same policy should treat those controls as bypassable in the interim.