CVE-2026-41485: Kyverno Policy Engine DoS Vulnerability

CVE-2026-41485 Overview

CVE-2026-41485 is a Denial of Service vulnerability in Kyverno, a policy engine designed for cloud native platform engineering teams. An unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff state. The same bug also causes the admission controller to drop connections and block all matching resource operations, creating a significant availability impact across Kubernetes clusters.

Critical Impact
Authenticated users with policy creation privileges can trigger a persistent denial of service condition that blocks all matching resource operations until the malicious policy is deleted.

Affected Products

Kyverno versions prior to 1.17.2
Kyverno versions prior to 1.16.4
Kyverno legacy engine (CEL-based policies are unaffected)

Discovery Timeline

2026-04-24 - CVE-2026-41485 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-41485

Vulnerability Analysis

This vulnerability stems from an unchecked type assertion in Kyverno's forEach mutation handler within the legacy engine. When processing mutation rules, the code directly casts the patchesJson6902 field to a string without validating whether the assertion succeeds. If the field is nil or contains an unexpected type, the type assertion panics, causing the entire controller process to crash.

The impact is particularly severe because the crash occurs in the background controller, which runs cluster-wide. Once triggered, the controller enters a persistent CrashLoopBackOff state, and the admission controller begins dropping connections. This effectively blocks all Kubernetes resource operations that match the affected policy rules until an administrator manually deletes the offending policy.

The vulnerability is confined to the legacy policy engine. Organizations using CEL-based policies are not affected by this issue.

Root Cause

The root cause is an unsafe type assertion in Go code within pkg/engine/mutate/mutation.go. The original code assumed that fe["patchesJson6902"] would always be a valid string, directly casting it with fe["patchesJson6902"].(string). This unchecked assertion causes a panic when the value is nil or a different type, as Go's type assertion without the comma-ok idiom will panic on failure.

Attack Vector

The attack can be executed by any authenticated user with permissions to create Policy or ClusterPolicy resources in the Kubernetes cluster. An attacker crafts a malicious policy containing a forEach mutation rule with a nil or incorrectly typed patchesJson6902 field. When Kyverno processes this policy, the unchecked type assertion triggers a panic, crashing the background controller and causing cascading failures in the admission controller.

// Vulnerable code - unchecked type assertion
if err != nil {
    return NewErrorResponse("variable substitution failed", err)
}
patcher := NewPatcher(fe["patchStrategicMerge"], fe["patchesJson6902"].(string))
if patcher == nil {
    return NewErrorResponse("empty mutate rule", nil)
}

// Fixed code - safe type assertion with comma-ok idiom
if err != nil {
    return NewErrorResponse("variable substitution failed", err)
}
jsonPatch, _ := fe["patchesJson6902"].(string)
patcher := NewPatcher(fe["patchStrategicMerge"], jsonPatch)
if patcher == nil {
    return NewErrorResponse("empty mutate rule", nil)
}

Source: GitHub Kyverno Commit Update

Detection Methods for CVE-2026-41485

Indicators of Compromise

Kyverno background controller pods entering CrashLoopBackOff state repeatedly
Kubernetes admission webhook timeouts or connection drops for Kyverno-managed resources
Recently created Policy or ClusterPolicy resources with forEach mutation rules containing suspicious or missing patchesJson6902 fields
Panic stack traces in Kyverno controller logs referencing pkg/engine/mutate/mutation.go

Detection Strategies

Monitor Kubernetes pod events for Kyverno controller crashes with CrashLoopBackOff status
Implement audit logging for Policy and ClusterPolicy creation events to track potentially malicious policy submissions
Review Kyverno controller logs for panic messages related to type assertion failures
Deploy alerting rules for admission webhook latency spikes or failure rates

Monitoring Recommendations

Configure Prometheus alerts for Kyverno controller restart counts exceeding normal thresholds
Implement centralized logging with pattern matching for Go panic traces in Kyverno namespaces
Monitor Kubernetes API server metrics for elevated admission webhook rejection rates
Establish baseline metrics for policy processing latency to detect anomalous behavior

How to Mitigate CVE-2026-41485

Immediate Actions Required

Upgrade Kyverno to version 1.17.2 or 1.16.4 immediately
Audit existing Policy and ClusterPolicy resources for suspicious forEach mutation configurations
Implement RBAC restrictions to limit policy creation permissions to trusted administrators only
Consider migrating from legacy engine policies to CEL-based policies, which are unaffected

Patch Information

Kyverno has released security patches in versions 1.17.2 and 1.16.4 that address this vulnerability. The fix implements a safe type assertion using Go's comma-ok idiom, which returns a zero value instead of panicking when the assertion fails. Organizations should upgrade to these versions or later to remediate the vulnerability.

Patch commits are available at:

For additional details, see the GitHub Security Advisory GHSA-fpjq-c37h-cqcv.

Workarounds

Restrict Policy and ClusterPolicy creation permissions using Kubernetes RBAC to trusted administrators only
Migrate existing legacy engine policies to CEL-based policies, which are not affected by this vulnerability
Implement admission control policies (using a separate controller) to validate Kyverno policy structure before creation
Deploy network policies to limit access to the Kubernetes API server from untrusted workloads

bash

# Example RBAC restriction to limit policy creation
kubectl create clusterrole kyverno-policy-admin \
  --verb=create,update,delete \
  --resource=policies.kyverno.io,clusterpolicies.kyverno.io

# Bind only to trusted administrators
kubectl create clusterrolebinding kyverno-policy-admin-binding \
  --clusterrole=kyverno-policy-admin \
  --user=trusted-admin@example.com