Is CVE-2026-122306 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122306 being exploited in the wild.

How severe is CVE-2026-122306?

High severity, with a CVSS score of 7.7, published 5 November 2026.

Is there a fix for CVE-2026-122306?

Yes: fixed in 1.19.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122306 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-122306?

Check whether you run Kyverno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122306: Kyverno denial of service via wildcard matching

CVE-2026-122306 · Severity: high · CVSS 7.7 · Published 2026-11-05

Kyverno is a policy engine for Kubernetes clusters that validates and enforces resource configurations. A denial of service vulnerability allows users with policy creation permissions to craft malicious patterns that cause the admission controller to consume CPU excessively, potentially blocking all resource operations cluster-wide. An attacker can pin CPU cores and trigger webhook timeouts that prevent legitimate Kubernetes operations from completing.

Technologies: Kyverno. Vendors: Kyverno.

Quick answers

Is CVE-2026-122306 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122306 being exploited in the wild.
How severe is CVE-2026-122306?: High severity, with a CVSS score of 7.7, published 5 November 2026.
Which products and versions are affected?: Kyverno before 1.19.2.
Is there a fix for CVE-2026-122306?: Yes: fixed in 1.19.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122306 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-122306?: Check whether you run Kyverno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.19.2

Technical details

The vulnerability exists in Kyverno's wildcard matching implementation (via the pinned go-wildcard v1.0.3 library), which uses recursive backtracking with exponential worst-case complexity. A namespaced policy author can trigger the issue during policy admission by submitting a Policy with crafted match and exclude resource names in the ValidateMatchExcludeConflict validation path, or during resource admission through pattern matching against user-controlled fields. The goroutine performing the match ignores request deadlines and continues spinning even after timeouts, causing cluster-wide webhook failures with failurePolicy: Fail.

Affected products

Kyverno Kyverno before 1.19.2

Timeline

2026-10-21: disclosed
2026-11-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.