CVE-2026-23881: Kyverno Policy Engine DoS Vulnerability

CVE-2026-23881 Overview

CVE-2026-23881 is a Denial of Service (DoS) vulnerability in Kyverno, a policy engine designed for cloud native platform engineering teams. The vulnerability exists in versions prior to 1.16.3 and 1.15.3 where unbounded memory consumption in Kyverno's policy engine allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables.

Critical Impact

Authenticated users with policy creation privileges can exhaust system memory resources, causing complete denial of service to the Kyverno policy engine and potentially impacting Kubernetes cluster operations.

Affected Products

• Kyverno versions prior to 1.16.3
• Kyverno versions prior to 1.15.3
• Kubernetes clusters running vulnerable Kyverno deployments

Discovery Timeline

• 2026-01-27 - CVE-2026-23881 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-23881

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in how Kyverno's policy engine processes context variables within policy definitions. When a malicious policy is crafted with context variables that reference and expand string data, the engine does not impose limits on memory allocation during string expansion operations.

The attack requires authenticated access with policy creation privileges, making it an insider threat or post-compromise escalation vector. Once exploited, the memory consumption grows exponentially as the engine recursively processes the amplified string data, eventually exhausting available memory and causing the policy engine to crash or become unresponsive.

Root Cause

The root cause is the absence of size limits on context variable expansion within the policy engine. Prior to the patch, there was no mechanism to constrain how much memory could be consumed when processing context variables that contain or reference string data. This allowed for exponential amplification attacks where small policy inputs could generate disproportionately large memory allocations.

Attack Vector

An attacker with policy creation privileges can craft a malicious Kyverno policy that uses context variables in a way that causes exponential string data amplification. When the policy engine processes this policy, it attempts to expand all context variables without checking the resulting memory footprint. The attack can be executed remotely over the network since Kyverno operates as a Kubernetes admission controller.

The following patch introduces a GetMaxContextSize configuration method to limit context variable expansion:

// GetMaxContextSize mocks base method.
func (m *MockConfiguration) GetMaxContextSize() int64 {
    m.ctrl.T.Helper()
    ret := m.ctrl.Call(m, "GetMaxContextSize")
    ret0, _ := ret[0].(int64)
    return ret0
}

// GetMaxContextSize indicates an expected call of GetMaxContextSize.
func (mr *MockConfigurationMockRecorder) GetMaxContextSize() *gomock.Call {
    mr.mock.ctrl.T.Helper()
    return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetMaxContextSize", reflect.TypeOf((*MockConfiguration)(nil).GetMaxContextSize))
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-23881

Indicators of Compromise

• Abnormal memory consumption spikes in Kyverno controller pods
• Kyverno policy engine pods repeatedly restarting due to OOM (Out of Memory) kills
• Recently created or modified policies with complex nested context variable references
• Kubernetes events showing policy admission webhook timeouts or failures

Detection Strategies

• Monitor Kyverno controller memory usage metrics for sudden unexplained increases
• Implement alerting on Kyverno pod restarts and OOMKilled events
• Audit policy creation and modification events to identify suspicious policy patterns
• Review Kyverno admission webhook latency metrics for degradation indicators

Monitoring Recommendations

• Configure Prometheus alerts for Kyverno memory usage exceeding baseline thresholds
• Enable Kubernetes audit logging for policy resource creation and modification
• Implement SentinelOne Kubernetes workload protection for anomaly detection
• Set up automated alerts for repeated pod restarts in the Kyverno namespace

How to Mitigate CVE-2026-23881

Immediate Actions Required

• Upgrade Kyverno to version 1.16.3 or 1.15.3 immediately
• Review and audit all existing policies for suspicious context variable usage patterns
• Implement resource limits on Kyverno controller pods to contain potential memory exhaustion
• Restrict policy creation privileges to trusted administrators only

Patch Information

The Kyverno team has released patched versions that introduce memory limits for context variable expansion. The fix adds a GetMaxContextSize configuration option that constrains the maximum size of context data during policy evaluation. Security patches are available in versions 1.16.3 and 1.15.3. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Apply Kubernetes resource limits to Kyverno pods to prevent complete node resource exhaustion
• Implement RBAC policies to restrict policy creation to a minimal set of trusted users
• Consider deploying admission control webhooks to validate policy complexity before applying
• Monitor and rate-limit policy creation operations in production environments

# Configuration example - Set resource limits on Kyverno deployment
kubectl patch deployment kyverno -n kyverno --type='json' -p='[
  {
    "op": "add",
    "path": "/spec/template/spec/containers/0/resources/limits",
    "value": {
      "memory": "2Gi",
      "cpu": "1000m"
    }
  }
]'