CVE-2026-122305 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno before 1.19.2 loops without bound when a resource's annotations re-introduce a policy variable into substitution, which exhausts CPU and memory. An attacker with low privileges can create such a resource and block cluster-wide admission.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any Kubernetes cluster running Kyverno admission control before 1.19.2 that lets users without cluster-admin rights create resources is exposed. Clusters where only trusted operators can create resources, or that do not run Kyverno, can skip it.
Not affected if kyverno-not-installed, version-1.19.2-or-later
Who cares kubernetes, kyverno, self-hosted
kubectl get deploy -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'1.19.21.19.2 or laterKyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.