CVE-2026-41485: Denial of Service in Kyverno via Unchecked Type Assertion in Mutation Engine

Vulnerability ID: CVE-2026-41485

CVSS Score: 7.7

Published: 2026-04-24

Kyverno policy engine versions prior to 1.16.4 and 1.17.0-rc1 through 1.17.1 are vulnerable to a Denial of Service. An unchecked Go type assertion in the legacy mutation engine triggers a runtime panic when processing missing JMESPath variables.

TL;DR

A Go type assertion panic in Kyverno's mutation engine allows authenticated users to crash the background and admission controllers, leading to a persistent DoS.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-617

Attack Vector : Network

CVSS Score : 7.7

EPSS Score : 0.00037

Impact : High (Denial of Service)

Exploit Status : PoC Available

Privileges Required : Low (Policy RBAC)

Affected Systems

Kyverno Legacy Mutation Engine

Kyverno Background Controller

Kyverno Admission Webhook

Kyverno : < 1.16.4 (Fixed in: 1.16.4 )

Kyverno : >= 1.17.0-rc1, <= 1.17.1 (Fixed in: 1.17.2…