Summary
An unchecked type assertion in Kyverno's variable-substitution engine allows any user who can submit a resource to crash the policy engine with a Go panic, whenever a policy uses the shallow-substitution syntax ({{- variable }}) on a field whose value is not a string. This yields a webhook denial of service and, for failurePolicy: Ignore policies, a silent policy bypass.
Impact
The vulnerability is in pkg/engine/variables/vars.go at the point where a shallow-substitution variable embedded inside a larger string is force-cast to string. If the resolved field value is any non-string JSON type — such as an integer, boolean, object, or array — the unchecked assertion panics. The statements slice is built from the admission resource (request.object.*), whose field types are entirely attacker-controlled. Two sibling instances of the same anti-pattern also exist in pkg/engine/apicall/apiCall.go and pkg/engine/context/loaders/imagedata.go. In the admission webhook path, net/http recovers the panic as a webhook error; for any policy with failurePolicy: Ignore, the admission request is admitted without policy evaluation, constituting a silent bypass. In the background and reports-controller paths, the panic produces a persistent crash-loop for as long as a matching resource exists in the cluster.
Detection
Kyverno logs the recovered panic as an internal server error in the policy-engine pod. Monitor Kyverno policy-engine pods for repeated restarts and admission webhook error rate increases. Any policy that uses {{- variable }} shallow-substitution syntax over a resource field that may resolve to a non-string type (such as spec.replicas, boolean flags, or nested objects) is reachable via any admission request for that resource kind. Inspect ClusterPolicy and Policy objects for shallow-substitution syntax used in pattern or message fields against typed fields. Consult the advisory at the reference URL for the proof-of-concept test case.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which fixes the unchecked type assertions in the variable-substitution engine and its sibling instances. Until upgraded, audit ClusterPolicy and Policy objects for any rule that uses the {{- variable }} shallow-substitution syntax referencing resource fields that may be non-string types, and rewrite affected rules to use standard {{ variable }} substitution instead, which does not trigger the assertion.
Related Security Guidance
References
- GHSA-x4xq-p8g4-6fwg — Kyverno Security Advisory