CVE-2026-41485
Fixed in a distro release EPSS <1%CVSS 7.7
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.
Products: kyverno
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kyverno/kyverno | 1.16.4 |
| Go | github.com/kyverno/kyverno | 1.17.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-kyverno-1.13 | no fix |
| Chainguard | commercial-kyverno-1.14 | no fix |
| Chainguard | commercial-kyverno-1.15 | no fix |
| Chainguard | commercial-kyverno-1.16 | no fix |
| Chainguard | commercial-kyverno-1.17 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.17 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.17 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.17 | no fix |
| Chainguard | commercial-kyvernopre-1.13 | no fix |
| Chainguard | commercial-kyvernopre-1.14 | no fix |
| Chainguard | commercial-kyvernopre-1.15 | no fix |
| Chainguard | commercial-kyvernopre-1.16 | no fix |
| Chainguard | commercial-kyvernopre-1.17 | no fix |
| Chainguard | kyverno-1.13 | no fix |
| Chainguard | kyverno-1.14 | no fix |
| Chainguard | kyverno-1.15 | no fix |
| Chainguard | kyverno-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-background-controller-1.13 | no fix |
| Chainguard | kyverno-background-controller-1.14 | no fix |
| Chainguard | kyverno-background-controller-1.15 | no fix |
| Chainguard | kyverno-background-controller-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-background-controller-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-background-controller-fips-1.13 | no fix |
| Chainguard | kyverno-background-controller-fips-1.14 | no fix |
| Chainguard | kyverno-background-controller-fips-1.15 | no fix |
| Chainguard | kyverno-background-controller-fips-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-background-controller-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-cleanup-controller-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cleanup-controller-fips-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-cleanup-controller-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cli-1.13 | no fix |
| Chainguard | kyverno-cli-1.14 | no fix |
| Chainguard | kyverno-cli-1.15 | no fix |
| Chainguard | kyverno-cli-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-cli-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cli-fips-1.13 | no fix |
| Chainguard | kyverno-cli-fips-1.14 | no fix |
| Chainguard | kyverno-cli-fips-1.15 | no fix |
| Chainguard | kyverno-cli-fips-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-cli-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-fips-1.13 | no fix |
| Chainguard | kyverno-fips-1.14 | no fix |
| Chainguard | kyverno-fips-1.15 | no fix |
| Chainguard | kyverno-fips-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-init-container-1.13 | no fix |
| Chainguard | kyverno-init-container-1.14 | no fix |
| Chainguard | kyverno-init-container-1.15 | no fix |
| Chainguard | kyverno-init-container-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-init-container-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-init-container-fips-1.13 | no fix |
| Chainguard | kyverno-init-container-fips-1.14 | no fix |
| Chainguard | kyverno-init-container-fips-1.15 | no fix |
| Chainguard | kyverno-init-container-fips-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-init-container-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-notation-aws | 1.1-r52 |
| Chainguard | kyverno-notation-aws-fips | 1.1-r46 |
| Chainguard | kyverno-readiness-checker-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-readiness-checker-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-reports-controller-1.13 | no fix |
| Chainguard | kyverno-reports-controller-1.14 | no fix |
| Chainguard | kyverno-reports-controller-1.15 | no fix |
| Chainguard | kyverno-reports-controller-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-reports-controller-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-reports-controller-fips-1.13 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.14 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.15 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-reports-controller-fips-1.17 | 1.17.2-r1 |
| Chainguard | reports-server | 0 |
| Wolfi | kyverno-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-background-controller-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-background-controller-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-cleanup-controller-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-cleanup-controller-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-cli-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-cli-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-init-container-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-init-container-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-notation-aws | 1.1-r52 |
| Wolfi | kyverno-readiness-checker-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-reports-controller-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-reports-controller-1.17 | 1.17.2-r1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |