Database/Container, Kubernetes & orchestration

Kyverno: CEL expressions evaluated without runtime cost limits OOM-kill the admission pods

CVSS 8.2CVE-2026-122309Container, Kubernetes & orchestrationcurated

Impact

NamespacedValidatingPolicy and NamespacedDeletingPolicy CEL expressions are evaluated without runtime cost limits, so nested map comprehensions over large ConfigMap fields exhaust CPU and memory and get the Kyverno pods OOM-killed. With the admission webhook down, resource operations across the whole cluster are blocked, which on a GPU fleet stops new tenant workloads from being placed and interferes with the pod churn a node drain depends on. The record puts the required privilege higher than the other Kyverno denial-of-service ids in this release (PR:H) and notes user interaction, so the realistic actor is a tenant-admin-level policy author rather than any namespaced user. The distinct code path is CEL evaluation cost, separate from the variable-substitution and wildcard-matching issues fixed in the same version.

Who can reach it

A high-privilege policy author able to create NamespacedValidatingPolicy or NamespacedDeletingPolicy objects. Authentication required.

What to do

Upgrade Kyverno to 1.19.2 or later and restart the Kyverno pods. Interim: limit who may author namespaced CEL policies and set memory limits/alerting on the Kyverno deployments so an OOM is visible. Control-plane only.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-122309 https://github.com/kyverno/kyverno/security/advisories/GHSA-m8p2-qqmx-j53x https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-unbounded-cel-policy-evaluation-cost

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.