Skip to content
Threat Feed

Tag

Policy-Engine

1 brief RSS
medium advisory

Kyverno Controller Denial of Service via forEach Mutation Panic

An unchecked type assertion in Kyverno versions v1.13.0 to v1.17.1 allows a user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff, leading to a denial of service, by crafting a malicious policy that triggers a nil pointer dereference in the forEach mutation handler.

Kyverno denial-of-service kubernetes policy-engine
2r 2t