The vulnerability is an unchecked type assertion in the forEach mutation handler of Kyverno's policy engine. When an authorized user creates a Policy or ClusterPolicy containing a forEach mutation, the controller panics, causing the cluster‑wide background controller to enter a persistent CrashLoopBackOff. Simultaneously the admission controller stops accepting connections, blocking all operations that match the policy. The result is a denial of service affecting the entire cluster while the crashing controller remains unrecoverable until the offending policy is deleted.

Kyverno up through version 1.17.1 and 1.16.3, as well as earlier releases, are affected. The issue is specific to the legacy engine; policies written using CEL are safe. Versions 1.17.2 and 1.16.4 contain the fix.

The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1% shows that exploitation is currently considered unlikely. The vulnerability is not listed in CISA's KEV catalog, but if an attacker has the ability to create or edit policies, they can trigger the crash by including a forEach mutation. The crash will persist until the policy is removed, making it an effective denial of service vector for any cluster administrator granting policy authorisation.