---
id: "CVE-2026-122319"
kind: "vulnerability"
aliases: ["CVE-2026-122319"]
title: "Kyverno: crafted resources crash the policy engine via In and NotIn operators"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kubernetes", "kyverno", "package"]
not_affected_if: ["kyverno-1.19.2-or-later"]
published_at: "2026-11-05T03:17:24+00:00"
first_seen_at: "2026-11-05T03:31:42+00:00"
updated_at: "2026-11-05T03:33:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122319", "first_seen_at": "2026-11-05T03:31:42+00:00"}]
exploit_sources: []
---

# Kyverno: crafted resources crash the policy engine via In and NotIn operators

Kyverno versions before 1.19.2 panic in the In and NotIn operators when a value evaluates to an array of integers, booleans, or mixed types because of an unchecked type assertion. An attacker who can submit resources to the cluster can crash the policy engine and disrupt admission control and policy enforcement.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kyverno version, for example with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`
- Look for policies that use the `In` or `NotIn` operators with JMESPath expressions over user-supplied resource fields

## Fix

- Kyverno: upgrade to `1.19.2` or later

## Timeline

- 2026-11-05T03:31:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122319

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-r2p2-3892-5jjf
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-in-notin-operator-panic

## From the sources

Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_