Kyverno: pathological wildcard patterns in policy match/exclude names pin admission controller cores

Impact

A namespaced policy author can submit a Policy whose match and exclude names expand exponentially in ValidateMatchExcludeConflict, pinning the admission controller's CPU until webhook calls time out. Admission then fails cluster-wide, so tenant pod creates, scheduler placements and the pod churn involved in draining a GPU node all stall. The attacker only needs rights to create policies in their own namespace, and the cost falls on the shared control plane. This is distinct from the other Kyverno denial-of-service ids in the same release: the expensive code path is wildcard match/exclude evaluation, not variable substitution or CEL cost.

Who can reach it

Any authenticated tenant allowed to create namespaced Kyverno Policy objects. Authentication required; no cluster-admin rights.

What to do

Upgrade Kyverno to 1.19.2 or later and restart the Kyverno pods. Until then, restrict who may create namespaced Policy objects. Control-plane change only - no node drain or reboot.

References

Related entries

• Kyverno: namespaced PolicyExceptions fold into generated ValidatingAdmissionPolicies, bypassing enforcementCVE-2026-122307 · Kyverno admissionpolicygenerator controller (PolicyException handling)High
• Kyverno: APICall URLPath query string defeats the namespace regex, reading cluster-scoped resourcesCVE-2026-122312 · Kyverno APICall Fetch() (pkg/engine/apicall/apiCall.go URLPath validation)High
• Kyverno: templated generate.clone namespace copies another tenant's ConfigMaps into the attacker's namespaceCVE-2026-122320 · Kyverno background controller (generate.clone / cloneList namespace templating)High
• docker-socket-proxy: CONTAINERS access lets any client export container filesystems and read filesCVE-2026-78122 · Tecnativa docker-socket-proxy (/containers read endpoints)High
• Kyverno: admission controller ServiceAccount token attached to outbound apiCall requests leaks to any endpointCVE-2026-84195 · Kyverno admission controller (apiCall service mode)High
• Kyverno: SSRF via apiCall.service.url lets authenticated users reach internal and metadata endpointsCVE-2026-84196 · Kyverno admission controller (apiCall.service.url variable substitution)High