High priorityDisclosed

Advisory · CVE-2026-122314

Crafted variables can crash Kyverno's policy engine and bypass enforcement

Kyverno before 1.19.2 has an unchecked type assertion in its variable-substitution engine: resources with non-string fields referenced by shallow {{- variable }} substitution cause a panic, yielding webhook denial of service and policy bypass under failurePolicy Ignore. Kyverno rates it CVSS 4.0 8.7.

Advisory published November 5, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-122314
CWE-248
Action timing
Immediate
ELI5

Explain it like I’m five

Kyverno assumes a value is text and crashes when it is not. One oddly shaped resource can knock over the webhook, and policies set to ignore failures simply let things through.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted resource submitted

    A user who can submit resources sends one with non-string fields referenced by {{- variable }} shallow substitution in a policy.

  2. 02Type assertion panics

    The variable-substitution engine hits an unchecked type assertion and panics.

  3. 03Webhook denial of service

    The panic disrupts the admission webhook.

  4. 04Policy bypass

    Under failurePolicy Ignore, the failed check admits resources that should have been blocked.

What happened

Kyverno disclosed CVE-2026-122314 for Kyverno before 1.19.2. An unchecked type assertion in the variable-substitution engine lets users who can submit resources crash the policy engine: resources with non-string fields referenced by {{- variable }} shallow substitution in policies cause a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.

The advisory rates it CVSS 4.0 8.7 and identifies Kyverno 1.19.2 as the fixed release.

What to do

  1. Inventory Kyverno installations and confirm the deployed version.
  2. Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
  3. While remediation is underway, consider failurePolicy Fail where the risk of bypass outweighs availability, if your deployment allows it.
  4. Watch admission webhook health and logs for policy engine panics.
  5. Review resources admitted during any webhook outage for policy violations.

Management note

A crash that also bypasses enforcement is two failures for the price of one: the webhook goes down and the policies stop applying. Check what slipped through during any outage, not just that the webhook recovered.