Vulnerability Description
Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kyverno | Kyverno | < 1.14.2 |
Related Weaknesses (CWE)
References
- https://github.com/kyverno/kyverno/commit/cbd7d4ca24de1c55396fc3295e9fc3215832bePatch
- https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggqExploitMitigationVendor Advisory
- https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggqExploitMitigationVendor Advisory
FAQ
What is CVE-2025-47281?
CVE-2025-47281 is a vulnerability with a CVSS score of 7.7 (HIGH). Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath varia...
How severe is CVE-2025-47281?
CVE-2025-47281 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-47281?
Check the references section above for vendor advisories and patch information. Affected products include: Kyverno Kyverno.