CVE-2026-122321: Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Clusters running Kyverno 1.18.0 before 1.19.2 are exposed where verifyImages policies rely on cached verification results. Exploitation requires an attacker who can submit workloads and change the registry tag referenced by those workloads.
What does an attacker need to do to exploit it?
The attacker must first cause Kyverno to cache a successful verification for a signed image tag, then repoint that same tag to an unverified image. A later cache hit can skip signature and attestation checks and admit the workload.
Why does mutateDigest increase the impact?
When the bypassed workload is admitted, mutateDigest can pin the image reference to the unverified digest. This allows the workload to use the attacker-selected image content even though the tag was previously verified.
How can I determine whether my environment is affected?
Check whether Kyverno is running a version from 1.18.0 through before 1.19.2, and whether verifyImages policies use image tags that can be moved. Also identify whether users or automation that can create workloads can modify, or rely on registries where they can modify, those tags.