PT-2025-30438 · Kyverno · Kyverno

Thevilledev · Publicado 2025-07-22 · Atualizado 2026-04-16 · CVE-2025-47281

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.14.1 and below

Description Kyverno is susceptible to a Denial of Service (DoS) vulnerability stemming from improper handling of JMESPath variable substitutions. Attackers possessing permissions to create or update Kyverno policies can exploit this by crafting expressions utilizing the {{@}} variable in conjunction with a pipe and an invalid JMESPath function (e.g., {{@ | non existent function }}). This results in a nil value being substituted into the policy structure. Subsequent processing by the getValueAsStringMap function, which expects string values, triggers a panic due to a type assertion failure. This can crash Kyverno worker threads within the admission controller and cause continuous crashes of the reports controller pod, potentially leading to service degradation or unavailability.

Recommendations Kyverno versions prior to 1.14.2 are affected. Update to version 1.14.2 or later to resolve this issue.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

CWE-248

Identificadores relacionados

BIT-KYVERNO-2025-47281

CLEANSTART-2026-UQ68343

CLEANSTART-2026-WI71304

CVE-2025-47281

ECHO-7558-E0E5-D2B2

GHSA-R5P3-955P-5GGQ

GO-2025-3823

OPENSUSE-SU-2025:15405-1

Produtos afetados

Kyverno

Referências · 112

• 🔥 https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47281.json · Exploit
• https://github.com/kyverno/kyverno · Nota
• https://github.com/kyverno/kyverno/commit/cbd7d4ca24de1c55396fc3295e9fc3215832be7c · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WI71304.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UQ68343.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34091 · Nota de Segurança
• https://suse.com/security/cve/CVE-2025-32019 · Nota
• https://suse.com/security/cve/CVE-2025-3228 · Nota
• https://osv.dev/vulnerability/CVE-2026-27139 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22039 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-47281 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-53826 · Nota
• https://suse.com/security/cve/CVE-2025-6023 · Nota