CVE-2026-122306
Description
A flaw was found in Kyverno. An authenticated attacker with policy creation privileges can cause a Denial of Service (DoS) by submitting policies containing crafted wildcard patterns. When evaluated, these complex patterns consume excessive processor resources, resulting in admission controller timeouts that block normal resource operations across the cluster.
Statement
This vulnerability is rated as an Important severity impact because an authenticated user with permissions to define namespaced policies can exhaust admission controller CPU resources, escalating a localized action into a cluster-wide denial of service. When policy specifications incorporate conflicting or complex pattern-matching rules, the validation routine enters pathological computation cycles. As the admission webhook ceases responding in time, subsequent resource creation and mutation requests across the cluster fail due to webhook timeouts.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate exponential backtracking wildcard evaluation within Kyverno policy validation routines: upgrade to Kyverno 1.19.2+ (or the corresponding fixed Red Hat builds), which replace exponential backtracking wildcard matching logic in ext/wildcard to prevent algorithmic complexity exhaustion, closing pathological wildcard patterns in policy match and exclude names. Until patched, this is a concern on Kubernetes clusters running Kyverno where authenticated users have privileges to create namespaced policies, so restrict and audit RBAC permissions that allow users to create or update namespaced Kyverno Policy resources. As a compensating measure, enforce admission controller policies using OPA or Gatekeeper to inspect and reject Kyverno Policy definitions with pathological wildcard patterns and enable Kubernetes API server audit logging for policy creation requests and payloads to detect attempts to deploy crafted wildcard patterns. These controls limit blast radius and contain exploitation, but they do not fix the underlying algorithmic complexity wildcard backtracking defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
