Denial-of-Service Vulnerability in Kyverno Policy Engine

CVE-2026-122319

What is CVE-2026-122319?

Kyverno versions prior to 1.19.2 are susceptible to a denial-of-service vulnerability that can be exploited through the In and NotIn operators. By submitting specially crafted resources that yield unexpected JMESPath-evaluated values—such as arrays containing integers, booleans, or mixed types—attackers can trigger a panic in the policy engine. This disruption affects the admission control and policy enforcement processes, posing a significant risk to Kubernetes environments relying on Kyverno for policy management.

References