high · CVSS v3 7.7 · CVSS v4 8.3

CVE-2026-122305

Kyverno 1.19.1 and earlier are vulnerable to a denial-of-service via self-referential variable templates. The flaw can be triggered by low-p

Overview

Kyverno 1.19.1 and earlier are vulnerable to a denial-of-service via self-referential variable templates. The flaw can be triggered by low-privileged users creating resources with annotations that reintroduce policy variables. It can exhaust CPU and memory, causing cluster-wide admission webhook hangs.

Description

Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission.

Impact

The denial-of-service can lead to availability loss for cluster administrators and developers. It compromises the integrity of the admission control process, potentially delaying or blocking legitimate resource creation. The attack is limited to users with permission to create resources, but the effect is cluster-wide.

Remediation

Upgrade Kyverno to version 1.19.2 or later. If upgrade is not possible, restrict resource creation to trusted users or disable the admission webhook temporarily. Monitor CPU/memory usage of the webhook and set resource limits to mitigate impact.

Risk context

High severity (CVSS v3 7.7, v4 8.3). No EPSS data available. Defenders should treat this as a high-priority issue and apply patches promptly.

Affected products

  • Kyverno 1.19.1
  • Kyverno 1.18
  • Kyverno 1.17
  • Kyverno 1.16
  • Kyverno 1.15

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.7
CVSS v4
8.3
EPSS
—

denial-of-service kyverno admission-webhook variable-substitution cluster-security high-severity

← All CVEs

Related CVEs

high

CVE-2026-122009

DataLinkDC Dinky versions up to 1.2.5 contain a Server-Side Request Forgery (SSRF) vulnerability in the FlinkWebURITemplateProxyServlet component. This flaw allows remote attackers to manipulate the _authority argument to force the server to make requests to unintended internal or external targets. The vulnerability is critical for environments where Dinky acts as a proxy for Flink web interfaces.

View analysis

high

CVE-2026-122188

A path traversal vulnerability exists in DeepGraphLearning's KnowledgeGraphEmbedding component, allowing remote attackers to manipulate the data_path argument during checkpoint loading. The flaw can lead to arbitrary file access and potential code execution. It is currently unpatched and publicly disclosed.

View analysis

high

CVE-2026-86442

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

View analysis

high

CVE-2026-90965

The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.

View analysis