CVE-2026-122321 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Kyverno versions prior to 1.19.2 represents a critical flaw in the signature verification logic for container images, specifically within the verifyImages feature. This security issue stems from an incorrect caching mechanism where verification results are indexed by the image reference string, such as a tag name like latest or v1.0, rather than being bound to the immutable cryptographic digest of the image content. In secure software architecture, identity should be derived from the content itself via its hash, not from mutable labels that can change over time. By relying on the tag for cache keying, Kyverno fails to distinguish between different images that share the same tag name but possess distinct contents and signatures. This design oversight creates a scenario where previously verified states are incorrectly reapplied to new or malicious content simply because they reside under an identical reference label.
The operational impact of this flaw allows an attacker with the ability to submit workloads and manipulate registry tags to bypass security controls entirely. The attack vector involves warming the Kyverno cache by submitting a workload that uses a legitimate, signed image associated with a specific tag. Once Kyverno verifies this initial image and stores its result in the cache keyed by the tag name, an attacker can subsequently repoint that same tag to point at a different, unverified or maliciously crafted image digest. When subsequent workloads are submitted using the same tag, Kyverno retrieves the cached verification result from memory without re-performing signature or attestation checks against the new content. This effectively treats the unverified image as if it were the previously verified one, allowing potentially compromised containers to be admitted into the cluster and executed with elevated privileges depending on the workload configuration.
Furthermore, this vulnerability is exacerbated by Kyverno's mutateDigest feature, which can automatically pin images to their digests during admission control. An attacker could exploit the cache bypass to have an unverified digest pinned in a way that aligns with the cached verification state of a trusted image. This creates a persistent security gap where subsequent deployments relying on these mutated configurations inherit the false sense of integrity established by the initial valid signature check. The flaw fundamentally undermines the trust model of supply chain security, as it decouples the cryptographic proof of authenticity from the actual binary content being deployed, rendering digital signatures ineffective against tag manipulation attacks within this specific version range.
To mitigate this risk, organizations running Kyverno must upgrade to version 1.19.2 or later immediately, where the caching mechanism has been corrected to bind verification results to image digests rather than mutable tags. In addition to upgrading, administrators should review their admission control policies for any reliance on tag-based identity assumptions and ensure that strict digest pinning is enforced at the policy level wherever possible. Monitoring registry activity for rapid tag repointing events can also provide early warning indicators of exploitation attempts. This issue aligns with CWE-295 Improper Certificate Validation, as it involves a failure to properly validate the integrity and authenticity of digital signatures relative to the actual content being processed. From an ATT&CK perspective, this vulnerability facilitates lateral movement and privilege escalation by allowing unauthorized container images to bypass admission controls, fitting within techniques related to Defense Evasion through resource hijacking or misconfiguration exploitation in cloud environments.