Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic

Summary

Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.

Remediation

1. Inventory every kyverno kyverno deployment, including staging.
2. Upgrade kyverno kyverno to 1.19.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/kyverno/kyverno/security/advisories/GHSA-r2p2-3892-5jjf
• Advisoryhttps://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-in-notin-operator-panic