{"id":"CVE-2026-122321","kind":"vulnerability","aliases":["CVE-2026-122321"],"related":[],"title":"Kyverno: cached image checks let swapped tags bypass signature verification","description":"Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.","summary":"Kyverno 1.18.0 before 1.19.2 caches image verification results by tag rather than by verified digest, so a cache hit skips signature and attestation checks. An attacker who can submit workloads and move a registry tag can get an unsigned image admitted to the cluster.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["container-images","infrastructure","kubernetes","kyverno","supply-chain"],"not_affected_if":["no-verifyimages-policy","patched-version"],"how_to_check":"- Check the installed Kyverno version with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`\n- Look for `verifyImages` rules in ClusterPolicy or Policy resources that use `mutateDigest`","fix":"- Kyverno: move to `1.19.2` or later","status":"open","published_at":"2026-11-05T03:17:25+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","triaged_at":"2026-11-05T03:33:09+00:00","updated_at":"2026-11-05T03:33:09+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T03:33:09Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: move to `1.19.2` or later","reach":"network","title":"Kyverno: cached image checks let swapped tags bypass signature verification","impact":"high","summary":"Kyverno 1.18.0 before 1.19.2 caches image verification results by tag rather than by verified digest, so a cache hit skips signature and attestation checks. An attacker who can submit workloads and move a registry tag can get an unsigned image admitted to the cluster.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","kyverno","supply-chain","container-images"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"unsigned container image admitted and run in the cluster","analyst_note":"Confirm the affected version range and whether the vendor advisory on github.com gives a workaround for versions that cannot upgrade.","how_to_check":"- Check the installed Kyverno version with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`\n- Look for `verifyImages` rules in ClusterPolicy or Policy resources that use `mutateDigest`\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["no-verifyimages-policy","patched-version"],"who_is_affected":"Clusters running Kyverno from 1.18.0 up to but not including 1.19.2 that use verifyImages rules to enforce image signatures. Exposure depends on whether workload submitters can push or move tags in a registry the cluster pulls from. Clusters without verifyImages policies, or running an earlier or patched Kyverno, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000751,"input_tokens":4323,"output_tokens":638,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122321':13A,16A '-2026':12A,15A '1.18.0':27B,71C '1.19.2':29B,73C 'admit':66B,136C 'attack':51B,112C 'attest':48B,109C 'bound':98C 'bypass':8A,78C 'cach':2A,30B,43B,82C,104C,125C 'chain':25B 'check':4A,49B,110C 'cluster':69B 'contain':18B,74C 'container-imag':17B 'cve':11A,14A 'digest':40B,102C,146C 'get':62B 'hit':44B,105C 'imag':3A,19B,31B,65B,89C,129C 'infrastructur':20B 'key':86C 'kubernet':21B 'kyverno':1A,22B,26B,70C,135C 'let':5A 'move':57B,118C 'mutatedigest':141C 'pin':143C 'rather':36B,96C 'refer':90C 'registri':59B,120C 'repoint':130C 'result':33B,84C 'sign':128C 'signatur':9A,46B,76C,107C 'skip':45B,106C 'string':91C 'submit':54B,115C 'suppli':24B 'supply-chain':23B 'swap':6A 'tag':7A,35B,60B,95C,121C,132C 'unsign':64B 'unverifi':145C 'use':140C 'verif':10A,32B,77C,83C 'verifi':39B,101C 'verifyimag':80C 'warm':123C 'workload':55B,116C,138C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno from 1.18.0 up to but not including 1.19.2 that use verifyImages rules to enforce image signatures. Exposure depends on whether workload submitters can push or move tags in a registry the cluster pulls from. Clusters without verifyImages policies, or running an earlier or patched Kyverno, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containerimages","critical","infrastructure","kubernetes","kyverno","supplychain"],"campaign_type":null,"first_public_at":"2026-10-21T15:58:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122321","severity":null,"published_at":"2026-11-05T03:17:25+00:00","modified_at":"2026-11-05T03:17:25+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","fetched_at":"2026-11-05T03:31:42+00:00","note":null}],"documents":[{"id":72722,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-2r43-6962-xcw5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T15:58:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72723,"url":"https://www.vulncheck.com/advisories/kyverno-1.18.0-before-1.19.2-verifyimages-cache-signature-verification-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}