Kyverno Policy Engine Flaw: Cluster Crash and Admission Controller Bypass

The National Vulnerability Database reports a high-severity vulnerability, CVE-2026-41485, in Kyverno, a policy engine for cloud-native platforms. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any authenticated user with permissions to create a Policy or ClusterPolicy to trigger a persistent CrashLoopBackOff in the cluster-wide background controller. This effectively takes the controller offline until the malicious policy is removed.

Beyond the background controller, this flaw also impacts the admission controller. The National Vulnerability Database indicates that the bug causes the admission controller to drop connections, blocking all matching resource operations. This means critical policy enforcement could be bypassed or rendered inoperable, creating a significant security gap. The good news is that the vulnerability is confined to the legacy engine; policies using Common Expression Language (CEL) are unaffected.

This isn’t just a nuisance; it’s a denial-of-service vector with serious security implications for policy enforcement. The CVSS score of 7.7 (HIGH) confirms the severity, particularly due to its network attack vector and high impact on availability. Patches are available in versions 1.17.2 and 1.16.4, addressing this critical issue.