Most recent entries from all

BIT-kyverno-2026-41485 — Kyverno Controller Denial of Service via forEach Mutation Panic

2026-10-04T04:05:56.926278+00:00

Affected: Bitnami: kyverno

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.

EUVD-2026-292966

2026-10-04T04:05:56.926343+00:00

EUVD-2026-292966

fkie_cve-2026-41485

2026-10-04T04:05:56.926361+00:00

GHSA-fpjq-c37h-cqcv — Kyverno Controller Denial of Service via forEach Mutation Panic

2026-10-04T04:05:56.926387+00:00

Affected: Go: github.com/kyverno/kyverno

### Summary

An unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected.

### Details

In `pkg/engine/mutate/mutation.go`, the `ForEach` function performs a bare type assertion on a map value that can be nil:

```go patcher := NewPatcher(fe["patchStrategicMerge"], fe["patchesJson6902"].(string)) ```

When a `forEach` rule uses a `patchesJson6902` field containing a variable substitution (e.g., `{{ element.nonexistent }}`) that resolves to `nil` at runtime, the type assertion `.(string)` on a nil `interface{}` triggers an unrecoverable Go panic:

``` panic: interface conversion: interface {} is nil, not string ```

When a `mutateExisting` rule triggers, the admission controller creates an `UpdateRequest` resource that the background controller processes asynchronously. This resource survives controller restarts, re-triggering the panic on every restart until the policy or `UpdateRequest` is deleted.

The background controller processes `mutateExisting` rules in worker goroutines where `k8s.io/apimachinery/pkg/util/runtime.HandleCrash` catches panics but re-panics by d…

WID-SEC-W-2026-1152 — Kyverno: Mehrere Schwachstellen

2026-10-04T04:05:56.926467+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kyverno ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und erweiterte Berechtigungen zu erlangen.