CVSS 8.3 (high) · published 2026-11-05
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.
Affected products (NVD): kyverno kyverno
Fixed in (NVD): 1.19.2
Weakness: CWE-407
Source: NVD CVE-2026-122306
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.