CVE-2026-122314

Description

Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by { {- variable } } shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.

References

• https://github.com/kyverno/kyverno/security/advisories/GHSA-x4xq-p8g4-6fwg
• https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-shallow-variable-substitution-panic