CVE-2025-47281 Overview
CVE-2025-47281 is a denial of service (DoS) vulnerability in Kyverno, a policy engine for Kubernetes and cloud-native platform engineering teams. The flaw affects Kyverno versions 1.14.1 and below. Attackers with permissions to create or update Kyverno policies can craft JMESPath expressions that crash both the admission controller worker threads and the reports controller pod. The vulnerability stems from improper handling of JMESPath variable substitutions when an invalid function is piped to the {{@}} variable. Kyverno fixed the issue in version 1.14.2.
Critical Impact
Authenticated users with policy creation rights can crash Kyverno controllers, disabling cluster-wide admission policy enforcement and reporting.
Affected Products
- Kyverno versions 1.14.1 and below
- Kyverno admission controller
- Kyverno reports controller
Discovery Timeline
- 2025-07-23 - CVE-2025-47281 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47281
Vulnerability Analysis
Kyverno evaluates policies using JMESPath expressions embedded in variable substitution syntax such as {{@}}. When a user pipes the {{@}} variable to a non-existent JMESPath function (for example, {{@ | non_existent_function }}), the substitution resolves to a nil value rather than raising a controlled error. Downstream code paths assume substituted values are strings and perform unchecked type assertions.
The internal getValueAsStringMap function executes an interface-to-string type assertion on the resulting nil value. The assertion fails with the Go runtime error interface {} is nil, not string, causing a panic. The panic terminates the worker handling the admission request and, in the reports controller, triggers continuous pod crash loops as the offending policy is reprocessed.
The issue is categorized under [CWE-20] Improper Input Validation. Exploitation requires authenticated access with permission to create or update Kyverno policy resources, but no user interaction is needed after policy submission.
Root Cause
The root cause is missing input validation in Kyverno's JMESPath evaluation layer. The engine does not reject expressions that reference unknown functions before substitution, and consuming functions such as getValueAsStringMap do not validate the type of the substituted value before asserting it as a string.
Attack Vector
The attack vector is network-based against the Kubernetes API server. An attacker with RBAC rights to write ClusterPolicy or Policy resources submits a manifest containing a malformed JMESPath substitution. Each subsequent admission request that matches the policy triggers a panic in a Kyverno worker thread. The reports controller enters a crash loop, halting policy reporting and degrading admission control across the cluster.
No public exploit code or proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-47281
Indicators of Compromise
- Kyverno admission controller logs containing the panic string interface {} is nil, not string
- Repeated CrashLoopBackOff events on the Kyverno reports controller pod
- Policy manifests containing JMESPath expressions of the form {{@ | <function_name> }} where the function is not a valid JMESPath built-in
- Increased Kubernetes admission webhook latency or webhook failure events tied to Kyverno
Detection Strategies
- Audit Kubernetes API server logs for create and update actions on ClusterPolicy and Policy resources, then inspect spec fields for JMESPath pipe expressions referencing unknown functions.
- Alert on Kyverno pod restart counts exceeding baseline, particularly the reports controller deployment.
- Parse Kyverno container logs for Go runtime panic stack traces referencing getValueAsStringMap.
Monitoring Recommendations
- Forward Kyverno controller logs and Kubernetes audit logs to a centralized SIEM for correlation against policy mutation events.
- Monitor admission webhook health metrics exposed by the Kubernetes API server, including apiserver_admission_webhook_rejection_count and webhook duration histograms.
- Track RBAC bindings that grant write access to Kyverno policy CRDs and review them against least-privilege requirements.
How to Mitigate CVE-2025-47281
Immediate Actions Required
- Upgrade Kyverno to version 1.14.2 or later across all clusters running the admission and reports controllers.
- Review existing ClusterPolicy and Policy resources for JMESPath pipe expressions referencing undefined functions and remove or correct them.
- Restrict RBAC permissions on Kyverno policy CRDs to a minimal set of trusted administrators and CI service accounts.
Patch Information
The fix is included in Kyverno 1.14.2. The upstream commit cbd7d4ca24de1c55396fc3295e9fc3215832be7c adds validation around JMESPath substitution results so that nil values no longer reach string type assertions. Refer to the Kyverno GitHub Security Advisory GHSA-r5p3-955p-5ggq and the upstream commit for full technical details.
Workarounds
- Remove or limit create and update permissions on Kyverno ClusterPolicy and Policy resources for non-administrator principals until the upgrade is applied.
- Enforce policy review through GitOps pipelines with linting that rejects JMESPath expressions referencing unknown functions.
- Configure pod-level readiness probes and resource limits on the reports controller to contain crash loop impact while patching.
# Upgrade Kyverno via Helm to the patched release
helm repo update
helm upgrade kyverno kyverno/kyverno \
--namespace kyverno \
--version 3.2.6 # ships Kyverno 1.14.2 or later
# Verify the running image tag
kubectl -n kyverno get pods -o jsonpath='{.items[*].spec.containers[*].image}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
