Kyverno: In/NotIn operators panic on non-string JMESPath arrays, crashing admission control

Impact

A resource whose JMESPath-evaluated values yield an array of integers, booleans or mixed types trips an unchecked type assertion in the In/NotIn operators and panics the policy engine. Policies written with these operators are exactly the ones that enumerate allowed values - permitted node pools, allowed GPU resource limits, allowed registries - so this is a reachable path in a typical GPU-cluster policy set, not a corner case. The effect is loss of admission control: denial of service while the webhook is down, or, where failurePolicy: Ignore is configured, resources admitted without the policy ever being applied.

Who can reach it

Any principal able to submit a resource evaluated by a policy that uses an In or NotIn operator - on a multi-tenant cluster, any tenant with create permission in a namespace. NVD records PR:N.

What to do

Upgrade Kyverno to 1.19.2 or later; patch the deployment and restart the Kyverno controllers, no node work needed. Before that, audit policies for In/NotIn conditions whose JMESPath can return non-string arrays, and note which of your webhooks run failurePolicy: Ignore, since those convert the panic into a quiet bypass.

References

Related entries

• Kyverno: unbounded decompression of attestation predicate layers OOM-kills the admission controllerCVE-2026-122322 · Kyverno attestation verification (extractStatement gzip predicate layer decompression)High
• Kyverno: unbounded decompression of notary signature layers exhausts admission controller memoryCVE-2026-122323 · Kyverno notary verification (FetchSignatureBlob gzip signature layer decompression)High
• Kyverno: namespaced tenants can template generate rules to write resources into any namespaceCVE-2026-124441 · Kyverno background-controller (generate rule target templating)High
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• local-path-provisioner: helper pod template injection yields a privileged pod with host root mountedCVE-2026-44543 · rancher/local-path-provisioner (helperPod.yaml template in local-path-config ConfigMap)High