CVE-2026-122321 is a critical signature verification bypass in Kyverno 1.18.0 before 1.19.2. An attacker who can submit workloads and change where a registry tag points can get unsigned or unverified container images admitted to a cluster.
What Is It
The flaw is in Kyverno's verifyImages feature. Kyverno caches the results of image verification, but it keys those results by the image reference string (such as a tag) instead of the digest it actually verified. When the cache has a hit, Kyverno skips the signature and attestation checks.
The weakness is classified as CWE-367, a time-of-check time-of-use (TOCTOU) race condition. According to the advisory, the attack works like this:
- The attacker submits a workload that uses a validly signed image, which puts a verification result in the cache.
- The attacker repoints the registry tag to a different, unverified image.
- The attacker submits a workload that uses the same tag. Kyverno finds the cached result and admits the workload. It then uses
mutateDigestto pin the workload to the unverified digest.
Why It Matters
Teams use verifyImages policies to make sure only signed, attested images run in their clusters. This bug breaks that guarantee without any visible failure. Because mutateDigest pins the unverified digest, the admitted workload looks like it was verified and locked to a specific digest.
- CVSS 3.1: 9.1 (CRITICAL),
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L - CVSS 4.0: 8.5 (HIGH), secondary score from VulnCheck
The attack is network-based and low complexity. It needs low privileges, specifically the ability to submit workloads and move a registry tag, and no user interaction. Integrity impact is rated high, and the scope is changed. The flaw is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied sources contain no confirmation of active exploitation.
What's Vulnerable
- Vendor/Product: Kyverno
- Affected: 1.18.0 up to, but not including, 1.19.2
- Unaffected: 1.19.2
NVD lists the record as "Awaiting Analysis." It has no CPE mappings yet.
Patch Status
The fix is in Kyverno 1.19.2. Organizations running 1.18.0 through 1.19.1 that rely on verifyImages for supply-chain enforcement should upgrade to 1.19.2. No CISA KEV required action or due date applies, because the CVE is not in the catalog.