CVE-2026-122305: Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop

Published Nov 5, 2026

Updated

Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission.

Event History

Nov 5, 2026

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker needs low-privileged access sufficient to create resources with crafted annotations. No user interaction is required.

Which installations are affected?

Kyverno versions before 1.19.2 are affected.

What operational symptoms could indicate exploitation?

The admission webhook may hang while CPU and memory consumption grows. This can block admission operations across the cluster.

CVE-2026-122305: Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop

Event History

Frequently Asked Questions

What level of access does an attacker need?

Which installations are affected?

What operational symptoms could indicate exploitation?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Which installations are affected?

What operational symptoms could indicate exploitation?