{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122319", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T23:25:07.316Z", "datePublished": "2026-11-05T02:25:18.583Z", "dateUpdated": "2026-11-05T02:25:18.583Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T02:25:18.583Z"}, "datePublic": "2026-10-21T00:00:00.000Z", "title": "Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic", "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Type Conversion or Cast", "cweId": "CWE-704", "type": "CWE"}]}], "affected": [{"vendor": "kyverno", "product": "kyverno", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.19.2"}, {"version": "1.19.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.19.2"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r2p2-3892-5jjf", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-r2p2-3892-5jjf)"}, {"name": "VulnCheck Advisory: Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-in-notin-operator-panic"}], "credits": [{"lang": "en", "value": "sagarkhandagre998", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "kyverno", "vendor": "kyverno", "versions": [{"lessThan": "1.19.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.19.2", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement."}], "id": "CVE-2026-122319", "lastModified": "2026-11-05T14:58:03.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-11-05T03:17:24.700", "references": [{"source": "[email protected]", "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r2p2-3892-5jjf"}, {"source": "[email protected]", "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-in-notin-operator-panic"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-704"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/kyverno/kyverno: Kyverno: Denial of Service via unexpected data types in In and NotIn operators", "id": "2567661", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567661"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-248", "details": ["Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.", "A flaw was found in Kyverno. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting specially crafted resources evaluated by the In and NotIn operators. Because the policy engine fails to properly validate unexpected data types, processing these inputs triggers an unhandled crash. This failure halts Kyverno's policy engine, disrupting cluster admission control and security policy enforcement."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122319", "public_date": "2026-11-05T02:25:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122319\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122319\nhttps://github.com/kyverno/kyverno/security/advisories/GHSA-r2p2-3892-5jjf\nhttps://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-in-notin-operator-panic"], "statement": "This vulnerability is rated as having Important impact because standard cluster tenants can trigger an unhandled runtime panic by submitting malformed object definitions, leading to a broad denial of service across admission webhooks without requiring administrative privileges. While crashing the service halts policy validation and resource ingestion, the defect does not compromise host confidentiality or permit arbitrary command execution. In standard Red Hat OpenShift environments, Kyverno is neither shipped nor enabled by default, as platform governance is handled through native admission controllers and Red Hat Advanced Cluster Management.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.19.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kyverno", "source": "cna", "vendor": "kyverno"}, "product": "kyverno", "vendor": "kyverno"}], "created": "2026-11-05T03:45:17.994802+00:00", "updated": "2026-11-06T14:45:05.205252+00:00", "vendors": ["kyverno", "kyverno$PRODUCT$kyverno"]}