CVE-2026-54462: Knative pkg webhook admission memory exhaustion

CVE-2026-54462 · Severity: medium · CVSS 6.5 · Published 2026-10-27

Knative pkg is a shared library used by multiple Kubernetes admission webhook controllers, including Knative, Tekton, KEDA, and Sigstore policy-controller. The library fails to limit the size of incoming admission requests, allowing a pod-network attacker to send an oversized request that consumes all available memory and crashes the webhook controller. This can delay or block critical admission decisions for cluster workloads.

Vendors: Go, Sigstore.

Quick answers

Is CVE-2026-54462 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54462 being exploited in the wild.
How severe is CVE-2026-54462?
Medium severity, with a CVSS score of 6.5, published 27 October 2026.
Which products and versions are affected?
CD Foundation Tekton all versions using affected pkg; knative.dev/pkg (Go) SEMVER:introduced=0,fixed=0.0.0-20260531000007-52dbd5ece63f; KEDA all versions using affected pkg; Knative all versions using affected pkg; and 3 more.
Is there a fix for CVE-2026-54462?
Yes. knative.dev/pkg (Go): upgrade to 0.0.0-20260531000007-52dbd5ece63f or later. Until then: Restrict network access to admission webhook endpoints to trusted control-plane clients only, or configure the webhook with failurePolicy=Ignore to allow other admissions to proceed if the webhook becomes unavailable. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54462 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-54462?
Check whether you run CD Foundation Tekton, knative.dev/pkg (Go), KEDA or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • knative.dev/pkg (Go): upgrade to 0.0.0-20260531000007-52dbd5ece63f or later
    go get knative.dev/pkg@v0.0.0-20260531000007-52dbd5ece63f

Restrict network access to admission webhook endpoints to trusted control-plane clients only, or configure the webhook with failurePolicy=Ignore to allow other admissions to proceed if the webhook becomes unavailable.

Technical details

The admission webhook handler in webhook/admission.go decodes untrusted AdmissionReview JSON using json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) without an http.MaxBytesReader or body-size limit, causing both the decoder and buffer to hold amplified copies of large requests in memory. An unauthenticated pod-network attacker can trigger an out-of-memory condition, killing the webhook controller process. The fix adds an http.MaxBytesHandler with a 3 MiB limit to truncate oversized requests.

Affected products

  • Knative pkg prior to 0.0.0-20260531000007-52dbd5ece63f
  • Knative Knative all versions using affected pkg
  • CD Foundation Tekton all versions using affected pkg
  • KEDA KEDA all versions using affected pkg
  • Sigstore policy-controller all versions using affected pkg
  • Kpack Kpack all versions using affected pkg

Identifiers

  • CVE-2026-54462
  • GHSA-2hw4-c9m4-f2fj
  • GO-2026-6880

Timeline

  • 2026-05-31: patched: Fix merged limiting webhook body size to 3 MiB
  • 2026-10-27: advisory: CVE-2026-54462 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.