Kyverno 1.18.0 Before 1.19.2 (< 1.19.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kyverno-1.18.0-before-1.19.2--1.19.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 04:27:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKyverno: Signature verification bypass via image tag cache poisoning (CVE-2026-122321)https://feed.craftedsignal.io/briefs/2026-11-kyverno-signature-bypass/Thu, 05 Nov 2026 04:27:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kyverno-signature-bypass/Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string rather than the verified digest.<p>Kyverno 1.18.0 before 1.19.2 is vulnerable to a signature verification bypass in verifyImages. Cached verification results are keyed by the image reference string (such as a tag) instead of the verified digest, causing cache hits to skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.</p> criticaladvisory