CVE-2026-41068: Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno’s apiCall context by validating the URLPath field. However, the ConfigMap context loader has the identical vulnerability — the configMap.namespace field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno’s privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters.