Kyverno: unchecked type assertion in shallow variable substitution panics the policy engine

Impact

Any principal that can submit a resource the policy engine evaluates can include a non-string field where a policy uses {{- variable }} shallow substitution, panicking the engine. On a GPU cluster Kyverno is usually the thing enforcing the rules that keep tenants apart - which images may run, whether a pod may ask for privileged mode, hostPath, or the host devices that expose GPUs. With failurePolicy: Ignore the panic turns into a policy bypass: the admission request is admitted unchecked, so a tenant can land a pod that policy would have refused. With failurePolicy: Fail it is instead a cluster-wide denial of service, blocking every scheduling decision until the webhook recovers.

Who can reach it

Anyone who can submit a resource that the Kyverno webhook evaluates - in practice any tenant with namespace-level create permission on a GPU cluster. NVD records PR:N (no authentication) for the vector; the practical requirement is API access to the cluster.

What to do

Upgrade Kyverno to 1.19.2 or later. This is a controller deployment rollout: patch the chart/image and restart the admission and reports controllers; no node drain or reboot. Until you can upgrade, review which policies use {{- ... }} shallow substitution and whether your webhooks run with failurePolicy: Ignore - Ignore converts the crash into a silent policy bypass and is the riskier of the two settings here.

References

Related entries

• Kyverno: non-string attestation `type` field panics image verification, bypassing signature checksCVE-2026-122315 · Kyverno image verification (buildStatementMap attestation statement parsing)High
• Kyverno: In/NotIn operators panic on non-string JMESPath arrays, crashing admission controlCVE-2026-122319 · Kyverno policy engine (`In` / `NotIn` operator JMESPath value handling)High
• Kyverno: unbounded decompression of attestation predicate layers OOM-kills the admission controllerCVE-2026-122322 · Kyverno attestation verification (extractStatement gzip predicate layer decompression)High
• Kyverno: unbounded decompression of notary signature layers exhausts admission controller memoryCVE-2026-122323 · Kyverno notary verification (FetchSignatureBlob gzip signature layer decompression)High
• Kyverno: namespaced tenants can template generate rules to write resources into any namespaceCVE-2026-124441 · Kyverno background-controller (generate rule target templating)High
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High