CVE-2026-122306 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno versions before 1.19.2 evaluate crafted wildcard patterns in policy match and exclude names in a way that pins CPU on the admission controller. A user who can create a namespaced Policy can cause cluster-wide webhook timeouts that block resource operations.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno before 1.19.2 where users other than cluster administrators can create namespaced Policy objects. The admission controller's CPU is the target, so clusters that restrict Policy creation to trusted operators have less exposure. Clusters on 1.19.2 or later are not affected.
Not affected if no-namespaced-policy-authors, version-1.19.2-or-later
Who cares kubernetes, kyverno, self-hosted
kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}' (the version is in the image tag)kubectl auth can-i create policies -n <namespace>1.19.2 or later (the sources state the fix is in versions before 1.19.2)Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.