Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M
CVE-2026-41485Kyverno Controller Denial of Service via forEach Mutation Panic
High 7.7
In plain English
A high-severity security flaw in kyverno from kyverno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kyverno/kyverno | 1.16.4 | GHSA-fpjq-c37h-cqcv |
| Go | github.com/kyverno/kyverno | 1.17.2 | GHSA-fpjq-c37h-cqcv |
| Go | github.com/kyverno/kyverno | 1.16.4, 1.17.2 | GO-2026-5374 |
Affected products (as reported)
Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H