CVE-2026-41485
Kyverno is a policy engine designed for cloud native platform engineering teams.
Published Apr 24, 2026 · updated Jun 17, 2026 · kyverno kyverno
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the mutation handler allows any user with permission to create a or to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 24, 2026 · NIST NVD
Detected
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the mutation handler allows any user with permission to create a or to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resour
Jun 17, 2026 · NIST NVD
Updated
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the mutation handler allows any user with permission to create a or to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resour
Affected
- cpe kyverno/kyvernoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41485
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41485
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the mutation handler allows any user with permission to create a or to crash the cluster-wide ba
nvd.nist.gov