7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41485

CVE-2026-41485: Kyverno Controller Denial of Service via forEach Mutation Panic

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41485

CVE-2026-41485:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kyverno/kyverno	go	>= 1.13.0, < 1.16.4	1.16.4
github.com/kyverno/kyverno	go	>= 1.17.0-rc.1, < 1.17.2	1.17.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the Kyverno controller caused by an unsafe type assertion in the ForEach function located in pkg/engine/mutate/mutation.go. When a Kyverno Policy or ClusterPolicy is created with a forEach mutation where the patchesJson6902 field contains a variable that resolves to nil, the code attempts a type assertion on a nil value, which triggers a panic.

This panic causes the Kyverno background controller to crash and enter a CrashLoopBackOff state, effectively disabling background policy enforcement and other background tasks. The admission controller is also affected, as it will drop connections for any resource operations that match the malicious policy, blocking those operations.

The identified vulnerable functions are github.com/kyverno/kyverno/pkg/engine/mutate.ForEach, which contains the faulty code, and github.com/kyverno/kyverno/pkg/engine/handlers/mutation.(*forEachMutator).mutateElements and github.com/kyverno/kyverno/pkg/engine/handlers/mutation.(*forEachMutator).mutateForEach, which are on the direct call path leading to the panic and would appear in a runtime profile during exploitation. The patch addresses the issue by replacing the unsafe type assertion with a safe one, preventing the panic.

Vulnerable functions

github.com/kyverno/kyverno/pkg/engine/mutate.ForEach

pkg/engine/mutate/mutation.go

The `ForEach` function contains a direct type assertion `.(string)` on the `fe["patchesJson6902"]` map value. When a `forEach` rule in a Kyverno policy uses a variable substitution that resolves to `nil` for the `patchesJson6902` field, this type assertion is performed on a `nil` interface, causing a panic and leading to a denial of service in the Kyverno controller.

github.com/kyverno/kyverno/pkg/engine/handlers/mutation.(*forEachMutator).mutateElements

pkg/engine/handlers/mutation/common.go

This function is part of the call stack that triggers the vulnerability. It iterates through elements in a `forEach` mutation and calls the vulnerable `ForEach` function. A malicious policy will cause this function's execution to lead to the panic in `ForEach`.

github.com/kyverno/kyverno/pkg/engine/handlers/mutation.(*forEachMutator).mutateForEach

pkg/engine/handlers/mutation/common.go

This function is higher in the call stack and is responsible for initiating the processing of `forEach` mutations. It calls `mutateElements`, which in turn calls the vulnerable `ForEach` function. This function is a key part of the execution path that leads to the denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.