Denial of Service in Kyverno Webhook for Kubernetes by Nirmata
CVE-2026-122305

8.3HIGH

Key Information:

Vendor

Kyverno

Status
Kyverno
Vendor
CVE Published:
5 November 2026

What is CVE-2026-122305?

Kyverno versions prior to 1.19.2 are vulnerable to a denial of service flaw that enables low-privileged users to exploit the admission webhook. By utilizing self-referential variable templates, attackers can create recursive resource annotations that lead to infinite substitution loops. This results in excessive consumption of CPU and memory resources, ultimately impairing admission control processes across the cluster and potentially causing disruptions in service availability.

Affected Version(s)

kyverno 0 < 1.19.2

kyverno 1.19.2

References

https://github.com/kyverno/kyverno/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/kyverno-before-1.19....
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

1diot9
.