Kyverno Denial of Service via Unlimited CEL Expression Evaluation

Executive Summary

This is a denial of service vulnerability in Kyverno versions before 1.19.2. It allows attackers with namespace-scoped policy authoring rights to craft malicious CEL expressions, such as nested map comprehensions over large ConfigMap fields, which consume excessive CPU and memory resources. This can crash Kyverno pods via OOM kills and disrupt cluster-wide admission processes.

Useful 0 Not Useful 0

Detection Guidance

Check Kyverno pod logs for high CPU/memory usage or OOM kills. Monitor admission controller delays or failures. Use commands like kubectl top pods -n kyverno to check resource consumption and kubectl get events --sort-by='.metadata.creationTimestamp' to identify suspicious policy submissions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can cause Kyverno pods to crash due to resource exhaustion, leading to denial of service for cluster admission controls. This may block legitimate workload deployments or policy validations across the entire cluster. Organizations using Kyverno for policy enforcement are at risk of operational disruptions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Implement runtime cost limits for CEL expressions if not available by default. Restrict namespace-scoped policy author permissions to prevent malicious submissions. Set webhook failure policy to 'Ignore' to avoid cluster-wide admission blocking during attacks.

Useful 0 Not Useful 0