{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122315", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T23:25:07.316Z", "datePublished": "2026-11-05T02:25:16.478Z", "dateUpdated": "2026-11-05T02:25:16.478Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T02:25:16.478Z"}, "datePublic": "2026-10-21T00:00:00.000Z", "title": "Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic", "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncaught Exception", "cweId": "CWE-248", "type": "CWE"}]}], "affected": [{"vendor": "kyverno", "product": "kyverno", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/kyverno/kyverno", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.19.2"}, {"version": "1.19.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.19.2"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-24cc-9745-hxfc)"}, {"name": "VulnCheck Advisory: Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic"}], "credits": [{"lang": "en", "value": "r0binak", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/kyverno/kyverno", "product": "kyverno", "vendor": "kyverno", "versions": [{"lessThan": "1.19.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.19.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller."}], "id": "CVE-2026-122315", "lastModified": "2026-11-05T14:58:03.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T03:17:24.200", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/kyverno/kyverno: Kyverno: Denial of Service via crafted attestation statements", "id": "2567858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567858"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-248", "details": ["Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.", "A flaw was found in Kyverno. An unauthenticated remote attacker can cause a Denial of Service (DoS) by supplying a crafted attestation statement containing an unexpected data type in an Open Container Initiative (OCI) manifest. Processing this payload triggers an internal application crash that halts the policy engine and can allow unverified images to bypass verification under permissive failure settings."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122315", "public_date": "2026-11-05T02:25:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122315\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122315\nhttps://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc\nhttps://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote party can cause policy engine crashes that degrade cluster availability and potentially bypass admission verification controls. When admission webhooks are configured with permissive failure policies, crashing the engine allows unverified container images to be admitted into production environments. Red Hat OpenShift does not ship Kyverno as a core component by default, meaning default platform installations are not directly exposed unless community or custom Kyverno deployments are utilized.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.19.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kyverno", "source": "cna", "vendor": "kyverno"}, "product": "kyverno", "vendor": "kyverno"}], "created": "2026-11-05T03:30:14.463771+00:00", "updated": "2026-11-05T04:45:14.149041+00:00", "vendors": ["kyverno", "kyverno$PRODUCT$kyverno"]}