CVE-2026-122319: Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic
Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the denial of service?
An attacker needs to be able to submit resources that are evaluated by Kyverno policies using the In or NotIn operators. The resource must cause a JMESPath expression to produce an array containing integers, booleans, or mixed types.
What is the operational impact of successful exploitation?
The unchecked type assertion can panic the Kyverno policy engine. This disrupts admission control and policy enforcement, creating a denial-of-service condition.
Which configurations are exposed?
Exposure depends on having Kyverno policies that use the In or NotIn operators on JMESPath-evaluated resource values. The provided information does not identify whether a default Kyverno policy configuration includes affected expressions.
How can defenders assess whether they may be affected?
Review Kyverno policy expressions that use In or NotIn and identify cases where the evaluated value can be an array of integers, booleans, or mixed types. Kyverno versions before 1.19.2 are affected according to the available information.