CVE-2026-122309 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno before 1.19.2 evaluates CEL expressions in namespace-scoped policies without runtime cost limits. A namespace policy author can use nested map comprehensions over large ConfigMaps to exhaust CPU and memory, get Kyverno pods OOM-killed, and block cluster-wide admission.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno before 1.19.2 where teams other than platform admins can create namespaced Kyverno policies. A namespace policy author can exhaust Kyverno's resources and block admission across the cluster. Clusters where only cluster administrators write policies are less exposed.
Not affected if kyverno-1.19.2-or-later, no-namespaced-policy-authors
Who cares kubernetes, kyverno, self-hosted
kubectl get deploy -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'NamespacedValidatingPolicy or NamespacedDeletingPolicy resources1.19.2 or laterKyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over large ConfigMap fields to OOM-kill Kyverno pods and block cluster-wide admission.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.