CVE-2026-122314 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Kyverno versions prior to 1.19.2 stems from an unchecked type assertion within the engine responsible for variable substitution during policy evaluation. This flaw specifically affects the handling of data types when policies attempt to reference variables using the shallow substitution syntax, denoted by {{- variable }}. In a properly secured system, any input received from external sources or user-submitted resources must be validated against expected schemas and type constraints before being processed by internal logic. However, in this instance, the Kyverno engine assumes that all fields referenced for substitution are of string type without performing adequate runtime checks to verify this assumption. When a resource containing non-string data types is submitted, the engine attempts to cast or access these values as strings, leading to a fatal panic due to invalid type assertion.
From an operational perspective, this technical flaw results in immediate denial of service for the Kyverno webhook component. Since Kyverno operates primarily through admission webhooks that intercept and validate Kubernetes resource creation and modification requests, a crash in the policy engine causes the entire validation process to fail. This disruption prevents legitimate workloads from being deployed or modified until the system is restarted or recovered. The severity of this impact is significantly amplified when the failurePolicy for the affected policies is set to Ignore. Under normal circumstances with a Fail policy, a webhook error would reject the request, maintaining security posture but potentially causing availability issues. However, under an Ignore setting, which is often used in production environments to prevent deployment blockers during initial rollout or maintenance windows, the system proceeds as if no validation occurred. Consequently, this creates a critical bypass of security controls, allowing malicious actors to deploy resources that would otherwise be blocked by Kyverno policies without triggering any error messages or alerts.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions from the Common Weakness Enumeration standards. The root cause is a failure to validate input data types before processing, which is a classic example of trusting user-supplied data without sufficient sanitization. In terms of adversary tactics, this flaw can be leveraged within the MITRE ATT&CK framework under T1562: Impair Defenses, specifically through techniques that disable or modify security tools and defenses to avoid detection. By crashing the defense mechanism (the Kyverno webhook), an attacker effectively blinds the cluster's admission control layer, facilitating unauthorized access or deployment of potentially malicious containers.
Mitigation strategies must focus on immediate version upgrades and configuration reviews. The primary remediation is to upgrade Kyverno to version 1.19.2 or later, where this type assertion issue has been resolved with proper input validation logic. Additionally, administrators should review their policy configurations, particularly those utilizing variable substitution. It is advisable to audit policies for the use of shallow substitution syntax and ensure that all referenced variables are guaranteed to be strings through explicit schema definitions in Kyverno ClusterPolicy or Policy resources. Implementing strict admission control schemas can help prevent non-string types from reaching the substitution engine in the first place, thereby reducing the attack surface even if a future vulnerability were introduced. Regular monitoring of webhook logs for panic errors and setting up alerts for sudden spikes in failed admissions can also provide early warning indicators of exploitation attempts against this or similar vulnerabilities.