critical · CVSS v3 9.1 · CVSS v4 8.5

CVE-2026-122321

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification result…

Description

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.

Scores

Severity
critical
CVSS v2
8
CVSS v3
9.1
CVSS v4
8.5
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-121933

A critical flaw in Linksys E5350 routers allows remote attackers to bypass authentication by manipulating the wizard_router_pwd parameter in the Setup Wizard. The vulnerability is exploitable without authentication and has a published exploit. It can lead to full administrative control over the device.

View analysis

critical

CVE-2026-122051

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-122302

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.

View analysis

critical

CVE-2026-122303

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

View analysis