Kyverno versions prior to 1.19.2 contain an unchecked type assertion in the variable‑substitution engine. If a user submits a resource that includes a non‑string field referenced by a shallow substitution expression {{- variable }}, the engine panics and crashes, causing a denial of service through the webhook and allowing policy enforcement to be bypassed when the failurePolicy is set to Ignore.

The vulnerability affects all deployments of the Kyverno policy engine before version 1.19.2. Users running an earlier release are susceptible, while versions 1.19.2 and later contain the fix.

With a CVSS score of 8.7 the vulnerability is classified as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating that either an exploit is not yet widely known or the risk is considered lower than reported. However, an attacker with the ability to submit cluster resources could trigger the panic by crafting a resource that uses a non‑string field in a shallow substitution, which results in a crash of the policy engine and potential policy bypass under a failurePolicy of Ignore.