CVE-2026-122305
Description
A flaw was found in Kyverno. An authenticated user with low privileges can trigger a Denial of Service (DoS) by submitting resources containing self-referential variable templates within annotations. When processing these annotations, Kyverno enters an unbounded substitution loop that exhausts system memory and processor resources. This condition causes the admission webhook to become unresponsive, blocking admission requests across the entire cluster.
Statement
This vulnerability is rated as Important because an authenticated user with minimal namespace-level privileges can disrupt cluster-wide operations. When Kyverno evaluates policy rules against incoming manifests with recursively nested variable references, the admission controller enters a continuous processing loop that depletes available host compute and memory resources. In multi-tenant environments, an unresponsive validating or mutating webhook stalls subsequent API admission requests across unrelated projects, escalating a localized object submission into a widespread platform outage.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unbounded recursive variable substitution in Kyverno admission controller variable evaluation: upgrade to Kyverno 1.19.2+ (or the corresponding fixed Red Hat builds), which prevents infinite recursive re-scanning and JMESPath query execution in substituteVariablesIfAny when resolving self-referential template expressions, closing all 2 injection vectors (crafted resource annotations containing self-referential variable templates, recursive variable template injection). Until patched, this is a concern on Kubernetes clusters running Kyverno with active policies that evaluate variables against user-submitted resource attributes, so restrict Kubernetes namespace resource creation and update privileges, audit submitted manifests for self-referential template expressions, and avoid policies embedding unconstrained user input into variable templates. As a compensating measure, apply process resource limits to bound CPU and memory consumption during unbounded substitution loops, configure service watchdog and automatic restart to restart the admission webhook process if it hangs, deploy an independent admission controller to inspect and reject manifests with self-referential template annotations before Kyverno processes them, monitor cgroup memory pressure events and pressure stall indicators to detect rapid resource depletion, and enable Kubernetes API server audit logging to capture incoming manifest submissions containing malicious annotation payloads. These controls limit blast radius and contain exploitation, but they do not fix the underlying infinite loop variable substitution defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
