Vulnerabilities

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by…

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Kyverno

Product

kyverno

CVSS v3.1

7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness

CWE-407

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-122306 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 18
   CVE NVD 19h ago

   Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting…

   CVSS 6.2 CVE-2026-122309 Kyverno