CVE-2025-47281

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/kyverno/kyverno/commit/cbd7d4ca24de1c55396fc3295e9fc3215832be7c	Patch
https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq	Vendor Advisory Exploit Mitigation
https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq	Vendor Advisory Exploit Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-07-23 21:15

Updated : 2025-08-05 15:51

NVD link : CVE-2025-47281

Mitre link : CVE-2025-47281

CVE.ORG link : CVE-2025-47281

JSON object : View

Products Affected

kyverno

kyverno

CWE

CWE-20

Improper Input Validation

CWE-248

Uncaught Exception

{"id": "CVE-2025-47281", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2025-07-23T21:15:26.397", "references": [{"url": "https://github.com/kyverno/kyverno/commit/cbd7d4ca24de1c55396fc3295e9fc3215832be7c", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "source": "[email protected]"}, {"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2."}, {"lang": "es", "value": "Kyverno es un motor de pol\u00edticas dise\u00f1ado para equipos de ingenier\u00eda de plataformas nativas de la nube. En las versiones 1.14.1 y anteriores, existe una vulnerabilidad de denegaci\u00f3n de servicio (DoS) debido al manejo inadecuado de las sustituciones de variables JMESPath. Los atacantes con permisos para crear o actualizar pol\u00edticas de Kyverno pueden manipular expresiones utilizando la variable {{@}} combinada con una barra vertical y una funci\u00f3n JMESPath no v\u00e1lida (p. ej., {{@ | non_existent_function }}). Esto provoca la sustituci\u00f3n de un valor nulo en la estructura de la pol\u00edtica. El procesamiento posterior por funciones internas, en concreto getValueAsStringMap, que esperan valores de cadena, genera un p\u00e1nico debido a un error en la aserci\u00f3n de tipo (la interfaz {} es nula, no de cadena). Esto bloquea los subprocesos de trabajo de Kyverno en el controlador de admisi\u00f3n y provoca bloqueos continuos del pod del controlador de informes. Esto se ha corregido en la versi\u00f3n 1.14.2."}], "lastModified": "2025-08-05T15:51:19.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEDDDB4F-5404-4385-AB85-96A449B748B2", "versionEndExcluding": "1.14.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}