Vulnerability Details CVE-2026-122305
Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 24.4%
CVSS Severity
CVSS v3 Score 7.7
References
Products affected by CVE-2026-122305
-
cpe:2.3:a:kyverno:kyverno:1.17.0
-
cpe:2.3:a:kyverno:kyverno:1.17.1
-
cpe:2.3:a:kyverno:kyverno:1.17.2
-
cpe:2.3:a:kyverno:kyverno:1.18.0
-
cpe:2.3:a:kyverno:kyverno:1.18.1
-
cpe:2.3:a:kyverno:kyverno:1.18.2
-
cpe:2.3:a:kyverno:kyverno:1.19.0
-
cpe:2.3:a:kyverno:kyverno:1.19.1