CVE-2026-122309 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over large ConfigMap fields to OOM-kill Kyverno pods and block cluster-wide admission.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in versions of Kyverno prior to 1.19.2 represents a critical denial of service risk stemming from the unbounded evaluation of Common Expression Language expressions within namespace-scoped policies. This flaw allows malicious or misconfigured policy authors to exhaust cluster resources by submitting CEL expressions that lack runtime cost limits, specifically targeting nested map comprehensions over large ConfigMap fields. The absence of computational boundaries during expression evaluation enables attackers to trigger excessive CPU consumption and memory allocation, ultimately leading to the out-of-memory termination of Kyverno pods and a subsequent blockage of admission control for the entire cluster.
From a technical perspective, the core issue lies in how Kyverno processes CEL expressions attached to NamespacedValidatingPolicy or NamespacedDeletingPolicy resources. When these policies reference large ConfigMap data structures, the evaluation engine iterates through nested map comprehensions without enforcing limits on execution time or memory usage. This behavior deviates from secure coding practices that mandate resource constraints for dynamic code execution environments. The vulnerability is classified under CWE-400, which covers uncontrolled resource consumption, and aligns with MITRE ATT&CK technique T1496, representing Resource Hijacking where an adversary consumes resources to disrupt service availability rather than stealing data or gaining unauthorized access.
The operational impact of this flaw is severe for Kubernetes clusters relying on Kyverno for admission control and policy enforcement. By exhausting the memory allocated to Kyverno pods through crafted CEL expressions, attackers can cause these critical components to crash repeatedly via out-of-memory kills. This disruption effectively neutralizes the cluster's ability to validate or mutate incoming requests, creating a window of opportunity where malicious workloads could be deployed without proper security checks. Furthermore, the constant restarts of Kyverno pods generate significant noise in monitoring systems and consume additional CPU cycles for recovery operations, degrading overall cluster performance and stability.
Mitigation strategies must focus on upgrading to version 1.19.2 or later, where these runtime cost limits have been implemented to prevent unbounded resource consumption during CEL evaluation. In environments where immediate patching is not feasible, administrators should enforce strict RBAC policies that restrict the ability of namespace-scoped policy authors to create NamespacedValidatingPolicy and NamespacedDeletingPolicy resources containing complex nested map comprehensions over large ConfigMaps. Additionally, implementing network policies and monitoring for anomalous CPU or memory spikes in Kyverno pods can help detect exploitation attempts early. Regular audits of CEL expressions used in cluster-wide policies are also recommended to ensure they adhere to best practices for computational efficiency and resource safety.