Database/Container, Kubernetes & orchestration
Kyverno: crafted forEach mutate policy crash-loops the background controller and blocks admission
Impact
An unchecked type assertion in the legacy engine's forEach mutation handler lets a crafted Policy or ClusterPolicy crash Kyverno's cluster-wide background controller into a persistent CrashLoopBackOff. The same bug makes the admission controller drop connections and block every operation on resources the policy matches. Depending on the webhook failure policy, that can stop pod creation for everyone on the cluster, including GPU job launches. The crash loop lasts until the policy is deleted. CEL-based policies are not affected.
Who can reach it
Authenticated user with permission to create a Kyverno Policy (namespaced) or ClusterPolicy. No other access is needed.
What to do
Upgrade Kyverno to 1.17.2 or 1.16.4, which rolls its controller pods. Nodes are not affected. If you are hit before upgrading, delete the offending policy to recover, and limit who can create Policy and ClusterPolicy objects.
References
Related entries
- Argo CD: ServerSideDiff exposes cleartext Kubernetes Secret data to users with app read accessCVE-2026-43824 · Argo CD (ServerSideDiff)High
- RHACM multicloud-operators-channel: managed-cluster agent reads all Secrets in hub Channel namespacesCVE-2026-73122 · Red Hat Advanced Cluster Management multicloud-operators-channel (hub subscription controller)High
- RHACM subscription controller: HelmRelease secretRef.Namespace reads Secrets from any namespaceCVE-2026-73137 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease secretRef)High
- OpenShift console: authenticated user makes the console pod fetch arbitrary URLs via a Helm chart URL (SSRF)CVE-2026-75888 · Red Hat OpenShift Container Platform console (Helm chart URL fetch)High
- RHACS Central: unbounded GraphQL query depth lets an authenticated user stall the management planeCVE-2026-9165 · Red Hat Advanced Cluster Security for Kubernetes (Central GraphQL API, query depth limit)High
- KubeVirt: Symlink path traversal in the virt-exportserver VMExport directory endpointCVE-2026-9804 · KubeVirtHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.