CVE-2026-122319 · Package
NO FIX YET · SEE WHAT TO DO
Kyverno versions before 1.19.2 panic in the In and NotIn operators when a value evaluates to an array of integers, booleans, or mixed types because of an unchecked type assertion. An attacker who can submit resources to the cluster can crash the policy engine and disrupt admission control and policy enforcement.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno before 1.19.2 are exposed, because the admission controller evaluates policies against submitted resources. The risk is highest where policies use In or NotIn over fields a user can set. Clusters on 1.19.2 or later, or without Kyverno, are not affected.
Not affected if kyverno-1.19.2-or-later
Who cares kubernetes, kyverno
kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'In or NotIn operators with JMESPath expressions over user-supplied resource fields1.19.2 or laterKyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.