CVE-2026-122321

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.18.0 through 1.19.1

Description A signature verification bypass exists in the verifyImages() function. The issue occurs because cached verification results are keyed by the image reference string, such as a tag, instead of being bound to the verified digest. Consequently, cache hits allow the system to skip signature and attestation checks. An attacker capable of submitting workloads and modifying a registry tag can populate the cache with a signed image, change the tag to point to a different image, and trick the system into admitting the workload while using mutateDigest to pin the unverified digest.

Recommendations Update Kyverno to version 1.19.2 or later.