A vulnerability in the Kyverno policy engine allows authenticated users with policy creation permissions to trigger a persistent denial of service that impacts cluster-wide resource operations.

This vulnerability, categorized as a reachable assertion (CWE-617), stems from an unchecked type assertion in the legacy engine's forEach mutation handler. Any user possessing the privileges to create a Policy or ClusterPolicy can trigger this flaw to force the admission controller into a persistent CrashLoopBackOff.

The successful exploitation of this vulnerability results in a complete denial of service for the admission controller, preventing the cluster from processing resource operations. Given the CVSS score of 7.7, the impact is high because it disrupts critical infrastructure management and automated policy enforcement within cloud native environments.

Immediate Action: Upgrade the Kyverno deployment to version 1.16.4 or 1.17.2 to incorporate the necessary patches for the legacy engine.

Proactive Monitoring: Monitor cluster logs for repeated CrashLoopBackOff events related to the Kyverno controller and audit the creation of new Policy or ClusterPolicy resources for suspicious configurations.

Compensating Controls: Restrict permissions for creating or updating Policy and ClusterPolicy resources to highly trusted administrative roles to prevent unauthorized users from triggering the crash.

Public Exploit Available: Unknown.

Organizations utilizing Kyverno must prioritize this update to maintain cluster stability and availability. By upgrading to the patched versions, administrators effectively neutralize the risk of unauthorized users inducing a persistent denial of service condition. Immediate deployment of the provided patches is strongly advised to ensure the resilience of the cloud native control plane.