CVE-2026-122306
HIGH
NVD
CVSS Score
7.7
Severity
HIGH
Published
Nov 05, 2026
Vendor
unknown
Description
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.