CVE-2026-122314 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno versions before 1.19.2 have an unchecked type assertion in the variable-substitution engine. A user who can submit Kubernetes resources can crash the policy engine, causing webhook denial of service and policy bypass when failurePolicy is Ignore.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno before 1.19.2 whose policies use shallow variable substitution on fields that can carry non-string values. Users who can submit resources to the cluster are the ones who can trigger the crash. Clusters on newer versions, or with no such policies, can skip it.
Not affected if no-shallow-substitution-policies, version-1.19.2-or-later
Who cares kubernetes, kyverno, self-hosted
kubectl get deploy -A -l app.kubernetes.io/name=kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'{{- variable }} shallow substitution on fields that may hold non-string valuesIgnore1.19.2 or laterKyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.