Kyverno Admission Webhook DoS via Variable Substitution Loop

Executive Summary

Kyverno before version 1.19.2 has a denial of service vulnerability in the substituteVariablesIfAny function. Low-privileged users can exploit this by creating resources with self-referential variable templates that trigger unbounded substitution loops. These loops consume excessive CPU and memory, hanging the admission webhook and blocking cluster-wide admission operations.

Useful 0 Not Useful 0

Detection Guidance

Monitor Kyverno pod resource usage for abnormal CPU or memory spikes. Check admission webhook logs for errors or timeouts during variable substitution. Use kubectl get pods -n kyverno to inspect pod status and logs for hanging processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to disrupt Kyverno's admission webhook, causing CPU and memory exhaustion. This can block resource creation across the entire cluster if the failure policy is set to Fail, leading to service outages and degraded performance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. If upgrading is not possible, disable admission webhook temporarily or restrict low-privileged user access to resource creation until patched.

Useful 0 Not Useful 0