CVE-2026-122315

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.2

Description An unchecked type assertion in the buildStatementMap() function allows unauthenticated attackers to crash the policy engine by providing crafted attestation statements. By pushing an OCI referrer manifest containing a non-string type field, an attacker can cause the reports-controller to enter a crash-loop or bypass image verification when the failurePolicy is set to Ignore.

Recommendations Update to version 1.19.2 or later.