---
id: "CVE-2026-122306"
kind: "vulnerability"
aliases: ["CVE-2026-122306"]
title: "Kyverno: crafted policy wildcards let namespace users exhaust admission controller CPU"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "kyverno", "self-hosted"]
not_affected_if: ["no-namespaced-policy-authors", "version-1.19.2-or-later"]
published_at: "2026-11-05T03:17:22+00:00"
first_seen_at: "2026-11-05T03:31:41+00:00"
updated_at: "2026-11-05T03:33:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122306", "first_seen_at": "2026-11-05T03:31:41+00:00"}]
exploit_sources: []
---

# Kyverno: crafted policy wildcards let namespace users exhaust admission controller CPU

Kyverno versions before 1.19.2 evaluate crafted wildcard patterns in policy match and exclude names in a way that pins CPU on the admission controller. A user who can create a namespaced Policy can cause cluster-wide webhook timeouts that block resource operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kyverno version with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'` (the version is in the image tag)
- Review which users can create Policy objects in namespaces with `kubectl auth can-i create policies -n <namespace>`

## Fix

- Kyverno: `1.19.2` or later (the sources state the fix is in versions before 1.19.2)

## Timeline

- 2026-11-05T03:31:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122306

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-8mrj-27wr-599g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-exponential-time-wildcard-matching

## From the sources

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_