{"id":"CVE-2026-122321","published":"2026-11-05T03:17:25.023","lastModified":"2026-11-05T03:17:25.023","description":"Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-2r43-6962-xcw5","tags":[]},{"url":"https://www.vulncheck.com/advisories/kyverno-1.18.0-before-1.19.2-verifyimages-cache-signature-verification-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-2r43-6962-xcw5","tags":[]}],"hasPoc":true,"ai":{"summary":"Kyverno 1.18.0–1.19.1 incorrectly caches image verification results keyed by tag (e.g., :latest) instead of by verified digest, allowing an attacker with registry write access to repoint a tag after caching a valid signature, causing Kyverno to admit unverified images.","exploitability":"Exploitation requires low-privilege access to submit Kubernetes workloads and the ability to move a container image tag in the registry (e.g., via push permissions), making it feasible for compromised developer accounts or insider threats.","blast_radius":"Successful exploitation allows unverified or malicious images to run in clusters, potentially leading to supply chain compromise, data exfiltration, or cluster takeover depending on workload permissions.","remediation":"Upgrade to Kyverno 1.19.2 or later, which binds cached verification results to the verified digest rather than the image reference string.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["image-verification-bypass","supply-chain","kubernetes","cache-poisoning"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:48:45.920Z"}}