CVE-2026-41485

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.

• CWE-617

• https://github.com/kyverno/kyverno/commit/76c8fdbe87328722e099e1fd44c3f21c9f7809cbPatch
• https://github.com/kyverno/kyverno/commit/80e728c2283a0c65e5adb02d8a907106e6ebe7e3Patch
• https://github.com/kyverno/kyverno/security/advisories/GHSA-fpjq-c37h-cqcvExploit, Vendor Advisory
• https://github.com/kyverno/kyverno/security/advisories/GHSA-fpjq-c37h-cqcvExploit, Vendor Advisory

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41479Authlib is a Python library which builds OAuth and OpenID Co…5.4
• CVE-2026-4148A use-after-free vulnerability can be triggered in sharded c…8.8
• CVE-2026-41481LangChain is a framework for building agents and LLM-powered…6.5
• CVE-2026-41482Frappe is a full-stack web application framework. Prior to 1…7.1
• CVE-2026-41483OpenTelemetry.Resources.Azure is the .NET resource detector …5.9
• CVE-2026-41484OpenTelemetry.Exporter.OneCollector is a .NET exporter that …5.9
• CVE-2026-41486Ray is an AI compute engine. From version 2.54.0 to before v…8.8
• CVE-2026-41487Langfuse is an open source large language model engineering …5.4
• CVE-2026-41488LangChain is a framework for building agents and LLM-powered…3.1
• CVE-2026-41489Pi-hole is a DNS sinkhole that protects devices from unwante…8.8
• CVE-2026-4149Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code …9.8
• CVE-2026-41490Dagster is an orchestration platform for the development, pr…8.3