---
title: "GHSA-gg4x-fgg2-h9w9: Bypassing Kyverno Policies via Double Policy Exceptions"
url: https://erroneo.us/security/ghsa/GHSA-gg4x-fgg2-h9w9/
description: "GHSA-gg4x-fgg2-h9w9 (critical, Go): Bypassing Kyverno Policies via Double Policy Exceptions. Summary If a cluster has a Kyverno policy in enforce mode and…"
type: advisory
section: "Security Digest"
date_published: 2026-01-06
date_modified: 2026-01-06
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-gg4x-fgg2-h9w9"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-gg4x-fgg2-h9w9: Bypassing Kyverno Policies via Double Policy Exceptions

## Affected packages

- Go `github.com/kyverno/kyverno` >= 1.9.0, <= 1.12.7 → fixed: 1.13.0

## Details

Summary If a cluster has a Kyverno policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second. Details The following policy was applied: And two exceptions: Trying to apply such a yaml will result in the expected ban: However, if the load name is changed to satisfy the second exception, the restrictions can be bypassed: It turns out that the second exception is higher in priority for Kyverno and allows for bypass of the restrictions. Impact The security restrictions can be bypassed.

## Sources

- [GitHub Advisory GHSA-gg4x-fgg2-h9w9](https://github.com/advisories/GHSA-gg4x-fgg2-h9w9)
- [github.com](https://github.com/kyverno/kyverno/security/advisories/GHSA-gg4x-fgg2-h9w9)

---
Source page: https://erroneo.us/security/ghsa/GHSA-gg4x-fgg2-h9w9/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt