Kyverno 1.19.2: Seven Critical Flaws Compared by Who Can Exploit Them

Kyverno released version 1.19.2 to remediate 24 security advisories (including nine Critical). Seven critical issues are emphasized: six allow a user with rights inside a namespace to operate with Kyverno’s service-account privileges (enabling cluster-wide reads/writes via policy-path exploits or mutate-existing targets), and one permits an image verification cache-based bypass of signature checks. The post groups the remaining 14 CVEs (CVSS 6.2–8.5), notes several require no privileges, and advises platform teams to inventory Kyverno installs, upgrade to 1.19.2, and tighten who can create policy-related objects while auditing policy rules and RBAC changes.