CVE-2026-122314

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.2

Description An unchecked type assertion in the variable-substitution engine allows users capable of submitting resources to crash the policy engine. By submitting resources containing non-string fields referenced by {{- variable }} shallow substitution in policies, an attacker can trigger a panic. This results in a webhook denial of service and can lead to a policy bypass when the failurePolicy is set to Ignore.

Recommendations Update to version 1.19.2 or later.