CVE-2026-122314

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
kyverno	kyverno	< 1.19.2

References

https://github.com/kyverno/kyverno/security/advisories/GHSA-x4xq-p8g4-6fwgExploit, Vendor Advisory
https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-shallow-variable-substitution-panicThird Party Advisory

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1223157.5Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy en CVE-2026-1223168.5Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows nam CVE-2026-1223174.3SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by s CVE-2026-1223187.7Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks whe CVE-2026-1223197.5Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy eng CVE-2026-122326.1The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int str CVE-2026-1223207.7Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namesp CVE-2026-1223219.1Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the i CVE-2026-1223227.5Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exha CVE-2026-1223237.5Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust m CVE-2026-1223243.1SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by suppl CVE-2026-1223253.1fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that a