Advisory · CVE-2026-122321
Kyverno image verification cache can be poisoned by moving a tag
Kyverno 1.18.0 before 1.19.2 keys cached verifyImages results by image reference string rather than the verified digest, so an attacker who can move a registry tag can have an unverified image admitted and pinned. Kyverno rates it CVSS 3.1 9.1.
- Vendor
- Kyverno
- Product
- Kyverno
- Identifier / CWE
- CVE-2026-122321
CWE-367 - Action timing
- Immediate
Explain it like I’m five
Kyverno remembers that a label was checked and trusted, but the label can be peeled off and stuck on a different image. The new image rides in on the old one's good reputation.
- 01Signed image warms the cache
An attacker who can submit workloads and move a registry tag first gets a signed image verified, caching the result under the tag.
- 02Tag repointed
The attacker repoints the tag at an unverified image.
- 03Cache hit skips checks
A later lookup hits the cache by reference string and skips signature and attestation checks.
- 04Unverified image admitted
Kyverno admits the workload and uses mutateDigest to pin the unverified digest.
What happened
Kyverno disclosed CVE-2026-122321 for Kyverno 1.18.0 before 1.19.2. The verifyImages cache keys results by the image reference string, such as a tag, rather than binding them to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.
The advisory rates it critical at CVSS 3.1 9.1 and identifies Kyverno 1.19.2 as the fixed release.
What to do
- Inventory Kyverno installations and confirm the deployed version.
- Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
- While remediation is underway, restrict who can push or retag images in registries Kyverno verifies, and prefer digest-pinned references.
- Review admission logs for workloads admitted by tag reference where the digest does not match a signed image.
- Check running workloads for images whose digests were never verified and redeploy anything suspect.
Management note
Image verification is only as strong as what the check is tied to. A cache keyed by a mutable tag turns a signature policy into a suggestion, so this one undermines the whole verifyImages control.