What is the CVSS score of CVE-2026-23881?

CVE-2026-23881 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kyverno are affected by CVE-2026-23881?

Kyverno policy engine versions up to 1.16.3 contain a resource exhaustion vulnerability that could allow attackers to disable cluster policy enforcement through denial-of-service, potentially…. A patch is available.

Is there a public PoC exploit available for CVE-2026-23881?

Yes, a public proof-of-concept exploit is available for CVE-2026-23881. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-23881?

Within 24 hours: Identify all Kyverno deployments and document current versions in use. Within 7 days: Test and deploy Kyverno 1.16.4 or later in non-production environments to validate compatibility. Within 30 days: Complete production upgrades across all clusters and verify policy enforcement functionality post-patch.

Kyverno CVE-2026-23881

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-01-27 security-advisories@github.com

GHSA-r2rj-wwm5-x6mq

Denial Of Service Kyverno Suse

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 02, 2026 - 15:20 vuln.today

Public exploit code

Patch released

Feb 02, 2026 - 15:20 nvd

Patch available

CVE Published

Jan 27, 2026 - 17:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.

AnalysisAI

Kyverno versions up to 1.16.3 is affected by allocation of resources without limits or throttling (CVSS 7.7).

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Kyverno cluster

Exploit

Create policy with exponential context variable expansion

Execution

Policy engine processes crafted policy

Impact

Unbounded memory consumption triggers DoS

Access

Authenticate to Kyverno cluster

Exploit

Create policy with exponential context variable expansion

Execution

Policy engine processes crafted policy

Impact

Unbounded memory consumption triggers DoS

Vulnerability AssessmentAI

Exploitation	User account with policy creation privileges on Kyverno cluster. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.7 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Kyverno deployments and document current versions in use. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-23881 vulnerability details – vuln.today

Back

Kyverno CVE-2026-23881

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code