Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-122321Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass

Critical 9.1

In plain English

A critical-severity security flaw in kyverno from kyverno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.2%top 86.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	1.18.0 – before 1.19.2

Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

References

GitHub Security Advisory (GHSA-2r43-6962-xcw5) vendor-advisory
VulnCheck Advisory: Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass third-party-advisory