high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-122314

Kyverno versions prior to 1.19.2 have an unchecked type assertion in the variable‑substitution engine that can crash the policy engine when

Overview

Kyverno versions prior to 1.19.2 have an unchecked type assertion in the variable‑substitution engine that can crash the policy engine when users submit resources with non‑string fields referenced by {{- variable }}. This causes a webhook denial‑of‑service and can bypass policies configured with failurePolicy Ignore. The flaw affects Kubernetes clusters that rely on Kyverno for admission control.

Description

Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.

Impact

The vulnerability primarily impacts availability by crashing the Kyverno webhook, leading to denial of service for admission requests. It also compromises integrity, as policies can be bypassed when failurePolicy is set to Ignore, allowing potentially malicious resources to be admitted. Cluster administrators and security teams are directly affected, as they must ensure policy enforcement remains reliable.

Remediation

Upgrade Kyverno to version 1.19.2 or later to eliminate the unchecked type assertion. If an upgrade is not immediately possible, restrict resource submission to trusted users via RBAC, disable failurePolicy Ignore where feasible, and monitor admission logs for panic events. Consider temporarily disabling the variable‑substitution feature or applying a custom admission controller that validates field types before passing to Kyverno.

Risk context

The CVE is rated high with a CVSS v3 score of 7.5 and a CVSS v4 score of 8.7. While no EPSS data is available, the severity indicates a significant risk that warrants prompt attention, especially in production environments where Kyverno is used for critical admission control.

Affected products

  • Kyverno 1.19.1
  • Kyverno 1.18.x
  • Kyverno 1.17.x
  • Kyverno 1.16.x
  • Kyverno 1.15.x
  • Kyverno 1.14.x
  • Kyverno 1.13.x
  • Kyverno 1.12.x

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
—

kyverno denial-of-service policy-bypass kubernetes webhook high-severity patch admission-control

← All CVEs

Related CVEs

high

CVE-2026-122009

DataLinkDC Dinky versions up to 1.2.5 contain a Server-Side Request Forgery (SSRF) vulnerability in the FlinkWebURITemplateProxyServlet component. This flaw allows remote attackers to manipulate the _authority argument to force the server to make requests to unintended internal or external targets. The vulnerability is critical for environments where Dinky acts as a proxy for Flink web interfaces.

View analysis

high

CVE-2026-122188

A path traversal vulnerability exists in DeepGraphLearning's KnowledgeGraphEmbedding component, allowing remote attackers to manipulate the data_path argument during checkpoint loading. The flaw can lead to arbitrary file access and potential code execution. It is currently unpatched and publicly disclosed.

View analysis

high

CVE-2026-86442

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

View analysis

high

CVE-2026-90965

The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.

View analysis