PT-2026-34849 · Kyverno · Kyverno

Thevilledev · Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-41485

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.17.2 Kyverno versions prior to 1.16.4

Description An unchecked type assertion in the forEach mutation handler allows a user with permissions to create a Policy or ClusterPolicy to cause the cluster-wide background controller to enter a persistent CrashLoopBackOff, which is a state where a container repeatedly crashes and restarts. This issue also causes the admission controller to drop connections and block all matching resource operations. The crash loop continues until the policy is deleted. This issue is limited to the legacy engine, while CEL-based policies are not affected.

Recommendations Update to version 1.17.2 Update to version 1.16.4

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BIT-KYVERNO-2026-41485

CVE-2026-41485

GHSA-FPJQ-C37H-CQCV

Affected Products

Kyverno

References · 10

• 🔥 https://github.com/kyverno/kyverno/security/advisories/GHSA-fpjq-c37h-cqcv · Exploit
• https://github.com/kyverno/kyverno/commit/76c8fdbe87328722e099e1fd44c3f21c9f7809cb · Patch
• https://github.com/kyverno/kyverno/commit/80e728c2283a0c65e5adb02d8a907106e6ebe7e3 · Patch
• https://osv.dev/vulnerability/BIT-kyverno-2026-41485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41485 · Security Note
• https://osv.dev/vulnerability/GHSA-fpjq-c37h-cqcv · Vendor Advisory
• https://github.com/kyverno/kyverno · Note
• https://twitter.com/_cvereports/status/2049063737244455240 · Twitter Post
• https://twitter.com/CVEnew/status/2048099318578462967 · Twitter Post
• https://twitter.com/dailycve/status/2047791718104273177 · Twitter Post