CVE-2026-122306

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.2

Description A denial of service issue allows namespaced policy authors to exhaust admission controller CPU resources by submitting pathological wildcard patterns. An attacker can create a Policy with specifically crafted match and exclude names that are processed by the ValidateMatchExcludeConflict() function. This process pins CPU cores, leading to cluster-wide webhook timeouts that block resource operations.

Recommendations Update to version 1.19.2 or later.