Denial of Service Vulnerability in Kyverno by Nirmata

CVE-2026-122309

What is CVE-2026-122309?

A denial of service vulnerability exists in Kyverno versions prior to 1.19.2, allowing namespace-scoped policy authors to overload CPU and memory resources. This can be exploited through the submission of certain CEL expressions without imposing runtime cost limits. By creating complex NamespacedValidatingPolicy or NamespacedDeletingPolicy configurations with extensive nested map comprehensions over large ConfigMap fields, an attacker can effectively cause Kyverno pods to be terminated due to excessive memory consumption, disrupting cluster-wide admissions.

References