CVE-2026-23881: high-severity vulnerability in kyverno
Kyverno Denial of Service via Context Variable Amplification in Policy Engine
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.6%
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected products
kyverno · kyvernoRelated CVEs — kyverno
In the same product, most dangerous first.
CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.8%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42813MEDIUMDenial of service from malicious manifest in kyvernoEPSS 0.7%CVE-2026-100706CRITICALkyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPathEPSS 0.6%CVE-2026-22039CRITICALKyverno Cross-Namespace Privilege Escalation via Policy apiCallEPSS 0.6%