CVE-2026-122309
Description
A flaw was found in Kyverno. This vulnerability allows an authorized user with policy creation permissions to cause a Denial of Service (DoS) by submitting Common Expression Language (CEL) expressions that are evaluated without runtime computational limits. By creating policies with resource-intensive expressions evaluated against large data fields, an attacker can exhaust system CPU and memory. This exhaustion causes Kyverno controller pods to crash, disrupting admission control and preventing new workloads from being processed across the cluster.
Statement
This vulnerability is assessed as Moderate severity because successful exploitation requires authenticated access with delegated permissions to author namespace-scoped policies. Although the resulting resource exhaustion can induce a denial of service that halts admission operations across the entire cluster, the flaw does not facilitate arbitrary code execution or compromise data confidentiality and integrity. In standard Red Hat OpenShift environments, Kyverno is not provided by default, meaning exposure is limited to deployments where the software is explicitly installed and policy creation rights are granted to untrusted tenants.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
