High severity7.5NVD Advisory· Published Nov 5, 2026

CVE-2026-122315

Description

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kyverno/Kyvernollm-fuzzy
Range: <1.19.2

Patches

Vulnerability mechanics

References

github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfcnvd
www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panicnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000