CVE-2026-23881highCWE-770

CVE-2026-23881: falha de alta gravidade em kyverno

Kyverno Denial of Service via Context Variable Amplification in Policy Engine

Publicada em

Seguir esta CVE+ Monitorar kyverno+ Monitorar github.com/kyverno/kyverno

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.6%
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Produtos afetados
kyverno · kyverno
CVEs relacionadas — kyverno

No mesmo produto, das mais perigosas para as menos.

CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.8%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42813MEDIUMDenial of service from malicious manifest in kyvernoEPSS 0.7%CVE-2026-100706CRITICALkyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPathEPSS 0.6%CVE-2026-22039CRITICALKyverno Cross-Namespace Privilege Escalation via Policy apiCallEPSS 0.6%