CVE-2026-41485

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41485
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41485.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41485
Aliases
Downstream
Related
Published
2026-04-24T03:27:08.865Z
Modified
2026-07-08T08:13:13.259879268Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
Summary
Kyverno Controller Denial of Service via forEach Mutation Panic
Details

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41485.json",
    "cwe_ids": [
        "CWE-617"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/kyverno/kyverno

Affected ranges

Type
GIT
Repo
https://github.com/kyverno/kyverno
Events
Introduced
978c2f3b56df37a8bea4ee649369efaea53a684b
Fixed
ead0a548e9b0e8746c6175abb53f8edff0aa5f1e
Introduced
3e5e775669753daae01e280298f85b4604db9198
Fixed
f64c0f5820a022d354c77316785d08511d2a5cc4
Fixed
76c8fdbe87328722e099e1fd44c3f21c9f7809cb
Fixed
80e728c2283a0c65e5adb02d8a907106e6ebe7e3
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:kyverno:kyverno:*:-:*:*:*:*:*:*",
        "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.13.0"
        },
        {
            "fixed": "1.16.4"
        },
        {
            "introduced": "1.17.0"
        },
        {
            "fixed": "1.17.2"
        }
    ]
}

Affected versions

kyverno-chart-3.*
kyverno-chart-3.7.0
kyverno-chart-3.7.1
kyverno-chart-3.7.1-rc.1
kyverno-chart-3.7.2-rc.1
kyverno-policies-chart-3.*
kyverno-policies-chart-3.7.0
kyverno-policies-chart-3.7.1
kyverno-policies-chart-3.7.1-rc.1
kyverno-policies-chart-3.7.2-rc.1
v1.*
v1.17.0
v1.17.1
v1.17.1-rc.1
v1.17.2-rc.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41485.json"