Signature Verification Bypass in Kyverno by Nirmata

CVE-2026-122321

What is CVE-2026-122321?

Kyverno versions 1.18.0 through 1.19.1 are susceptible to a signature verification bypass, where cached verification results are tied to image reference strings instead of the verified digest. This flaw enables an attacker with the ability to submit workloads and modify registry tags to manipulate the cache using a signed image. By changing the tag to point to an unverified digest, the attacker can bypass necessary signature and attestation checks, allowing compromised workloads to be admitted.

References