Summary
Kyverno's In and NotIn policy engine operators perform an unchecked type assertion when the evaluated key is a []interface{}. When the array contains non-string values — such as integers or booleans, which JMESPath naturally returns from expressions like {{ request.object.spec.* }} — the assertion v.(string) panics at runtime. The AnyIn and AllIn operators already handle this correctly via fmt.Sprint(v), but In and NotIn in pkg/engine/variables/operator/in.go and notin.go do not.
Impact
An attacker who can submit or influence resource definitions evaluated by Kyverno policy rules can reliably trigger a runtime panic by crafting a resource that causes a JMESPath expression to return a non-string array. The panic crashes the admission controller or policy engine component, causing denial of service. This disrupts admission control and prevents policy enforcement, which may affect cluster stability depending on how the admission controller failure policy is configured.
Detection
There is no public Falco rule documented for this advisory. Monitor Kyverno admission controller pod restarts and examine controller logs for panic: interface conversion: interface {} is int, not string errors. Audit policy rules that use the In or NotIn operators with JMESPath expressions that could return non-string arrays (for example, expressions referencing numeric fields such as spec.replicas or mixed-type arrays).
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which addresses the unsafe type assertion. Until the upgrade is complete, audit policies that use the In or NotIn operators and modify JMESPath expressions to ensure they explicitly return string values. Consider converting numeric or boolean fields to strings before comparison, using the same pattern that AnyIn and AllIn already implement.