Kyverno: self-referential variable templates hang the admission webhook, blocking cluster-wide admission

Impact

A low-privileged tenant can create a resource whose annotations re-introduce an embedded policy variable, driving substituteVariablesIfAny into an unbounded substitution loop that burns CPU and memory in the Kyverno pods. Once the admission webhook stops answering, every admission request in the cluster stalls - including the pod creates that a GPU scheduler needs to place work, and the evictions and recreates an operator needs during a node drain. On a GPU fleet this is an availability event for the whole cluster, not just the attacker's namespace, because Kyverno sits in the path of all resource operations. Any namespaced tenant is enough; no cluster-admin rights are needed.

Who can reach it

Any authenticated tenant with namespaced create rights on resources that Kyverno policies match. No cluster-level privilege required; reachable from inside a tenant namespace over the Kubernetes API.

What to do

Upgrade Kyverno to 1.19.2 or later and roll the Kyverno deployments. Control-plane only: no GPU node drain or reboot, but plan for the admission webhook being briefly unavailable during the rollout (check failurePolicy so the restart does not itself block admission).

References

Related entries

• Kyverno: pathological wildcard patterns in policy match/exclude names pin admission controller coresCVE-2026-122306 · Kyverno admission controller (ValidateMatchExcludeConflict wildcard matching)High
• Kyverno: namespaced PolicyExceptions fold into generated ValidatingAdmissionPolicies, bypassing enforcementCVE-2026-122307 · Kyverno admissionpolicygenerator controller (PolicyException handling)High
• Kyverno: APICall URLPath query string defeats the namespace regex, reading cluster-scoped resourcesCVE-2026-122312 · Kyverno APICall Fetch() (pkg/engine/apicall/apiCall.go URLPath validation)High
• Kyverno: templated generate.clone namespace copies another tenant's ConfigMaps into the attacker's namespaceCVE-2026-122320 · Kyverno background controller (generate.clone / cloneList namespace templating)High
• docker-socket-proxy: CONTAINERS access lets any client export container filesystems and read filesCVE-2026-78122 · Tecnativa docker-socket-proxy (/containers read endpoints)High
• Kyverno: admission controller ServiceAccount token attached to outbound apiCall requests leaks to any endpointCVE-2026-84195 · Kyverno admission controller (apiCall service mode)High