Overview
A severe vulnerability identified as CVE-2025-47281 has been discovered in the Kyverno policy engine, a tool often utilized by cloud-native platform engineering teams. This flaw, affecting versions 1.14.1 and below, could allow attackers to cause a Denial of Service (DoS), potentially leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-47281
Severity: High (7.7 CVSS)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Denial of Service, potential system compromise, and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Kyverno Policy Engine | 1.14.1 and below
How the Exploit Works
The vulnerability arises due to the improper handling of JMESPath variable substitutions in Kyverno. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function. This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, result in a panic due to a type assertion failure. This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod.
Conceptual Example Code
Consider the following example of a malicious policy:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: exploit-cve-2025-47281
spec:
rules:
- name: exploit
match:
resources:
kinds:
- Pod
mutate:
overlay:
spec:
containers:
- (name): "*"
resources:
limits:
cpu: "{{@ | non_existent_function }}"In this example, the attacker crafts a malicious expression (`{{@ | non_existent_function }}`) that leads to a nil value being substituted into the policy structure, triggering the vulnerability.
