---
id: "CVE-2026-122315"
kind: "vulnerability"
aliases: ["CVE-2026-122315"]
title: "Kyverno: unchecked type assertion lets crafted attestations crash policy engine"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "kyverno", "self-hosted"]
not_affected_if: ["kyverno-1.19.2-or-later", "kyverno-not-installed", "no-image-verification-policies"]
published_at: "2026-11-05T03:17:24+00:00"
first_seen_at: "2026-11-05T03:31:42+00:00"
updated_at: "2026-11-05T03:33:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122315", "first_seen_at": "2026-11-05T03:31:42+00:00"}]
exploit_sources: []
---

# Kyverno: unchecked type assertion lets crafted attestations crash policy engine

Kyverno before 1.19.2 has an unchecked type assertion in buildStatementMap that panics on a crafted attestation statement. An unauthenticated attacker can push an OCI referrer manifest with a non-string type field to crash the policy engine or bypass image verification when failurePolicy is Ignore.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kyverno version with `kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'`
- Check whether the Kyverno admission policies use image verification with `failurePolicy: Ignore`
- Check the reports-controller for crash loops with `kubectl get pods -n kyverno`

## Fix

- Kyverno: move to `1.19.2` or later (the sources state the fix is in 1.19.2)

## Timeline

- 2026-11-05T03:31:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122315

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic

## From the sources

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_