CVE-2026-122309

Medium CVSS 6.2

Published 2026-11-05 · last changed 2026-11-05

The fix

We hold no Microsoft remediation data for CVE-2026-122309, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over large ConfigMap fields to OOM-kill Kyverno pods and block cluster-wide admission.

Sources

NVD record for CVE-2026-122309

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H