CVE-2026-122306: Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching

Published Nov 5, 2026

Updated

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.

Event History

Nov 5, 2026

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs permission to create a namespaced Kyverno Policy. They can submit a policy containing crafted wildcard patterns in match and exclude names.

What cluster functions can be affected?

The crafted policy can exhaust CPU in the admission controller by pinning cores during ValidateMatchExcludeConflict evaluation. This can cause cluster-wide webhook timeouts that block resource operations.

Are all Kyverno versions affected?

Kyverno versions before 1.19.2 are affected. The provided data does not identify any other affected configuration conditions.

CVE-2026-122306: Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching

Event History

Frequently Asked Questions

Who can exploit this issue?

What cluster functions can be affected?

Are all Kyverno versions affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What cluster functions can be affected?

Are all Kyverno versions affected?