CVE-2022-3162

score

<0.1

cvss

6.5

epss

1.2%

published

2023-03-01

kev added

—

first seen

2026-10-21

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization, if multiple CRDs share the same API group and specific permissions are set. Exploit requires cluster-wide list or watch permissions on one resource type.