CVE-2026-122314
Description
A flaw was found in Kyverno. An attacker authorized to submit resources can cause a Denial of Service (DoS) by providing unexpected non-string data in fields evaluated by policy variable substitutions. Because the variable-substitution engine fails to properly verify data types, processing this input causes the admission webhook to crash. This disruption halts policy enforcement and may allow unauthorized resources to bypass security controls if the system is configured to ignore failures.
Statement
This vulnerability is rated as having a Moderate impact because successful exploitation requires an authenticated actor with privileges to create or alter resources within the cluster, restricting the overall blast radius to internal tenants. In standard deployments, the admission controller panics upon handling unexpected data types within policy variables, resulting in a temporary service outage. While an outage can lead to policy checks being skipped if admission rules are explicitly configured to ignore failures, it does not directly expose sensitive data or facilitate arbitrary code execution.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When input does not comply with the expected type, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities that would not be possible if the input conformed with the expected type.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
