Kyverno before version 1.19.2 contains a flaw in the In and NotIn operators that can cause a panic when processing certain JMESPath-evaluated values, such as arrays of integers, booleans, or mixed types. The panic disables the policy engine, interrupting admission control and policy enforcement and resulting in a denial of service to workloads being admitted. This vulnerability is an example of improper type handling (CWE-704). The impact is limited to the availability of the policy enforcement component; it does not expose any data or allow remote code execution, but it can lock out users from deploying or updating applications until the engine is restarted.

Kyverno deployments running any version earlier than 1.19.2 are affected. The vulnerability exists in the policy engine component of Kyverno, regardless of the Kubernetes cluster size or configuration. Users must ensure their installations are upgraded to 1.19.2 or later.

With a CVSS score of 8.7, the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating that, at the time of this analysis, the exploitation risk remains uncertain but could be significant if attackers target public or poorly protected clusters. Based on the description, the likely attack path involves sending crafted Kubernetes admission requests that trigger the In or NotIn operator with values that coerce into unsupported types, causing a panic in the policy engine. The vulnerability requires access to the admission controller API or the ability to submit admission requests, which is a remote attack vector in most Kubernetes environments.