Skip to content
Fencer Vulns
high 7.7

CVE-2026-41485 json

Kyverno Controller Denial of Service via forEach Mutation Panic

published 2026-04-24 6 mo ago modified 2026-09-10 1 mo ago also BIT-kyverno-2026-41485 , EUVD-2026-25392 , GHSA-fpjq-c37h-cqcv , GO-2026-5374

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits
0
none known

Summary

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.

Patch / fix

  • go github.com/kyverno/kyverno 1.16.4, 1.17.2
  • bitnami kyverno 1.16.4, 1.17.2
  • kyverno kyverno 1.16.4, 1.17.2
  • nirmata kyverno 1.16.4, 1.17.2
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-fpjq-c37h-cqcv referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
GitHub 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
OSV 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/kyverno/kyverno
>=1.13.0, <1.16.4
>=1.17.0-rc.1, <1.17.2
1.16.4
1.17.2
bitnami kyverno
<1.16.4
>=1.17.0, <1.17.2
1.16.4
1.17.2

Affected products

  • kyverno kyverno

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.