Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck
CVE-2026-122315Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic
High 7.5
In plain English
A high-severity security flaw in kyverno from kyverno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 65.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.
Affected products (as reported)
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-24cc-9745-hxfc) vendor-advisory
- VulnCheck Advisory: Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic third-party-advisory