---
id: CVE-2026-122315
title: Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic
summary: >-
  Kyverno before 1.19.2 contains an unchecked type assertion in
  buildStatementMap that allows unauthenticated attackers to crash the policy
  engine via crafted attestation statements. Attackers can push an OCI referrer
  manifest with a non-s…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-248
vendor: kyverno
product: kyverno
affected:
  - kyverno < 1.19.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:25:16.478Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122315'
references:
  - url: 'https://github.com/kyverno/kyverno/security/advisories/GHSA-24cc-9745-hxfc'
    label: GitHub Security Advisory (GHSA-24cc-9745-hxfc)
  - url: >-
      https://www.vulncheck.com/advisories/kyverno-before-1.19.2-image-verification-bypass-via-attestation-type-panic
    label: >-
      VulnCheck Advisory: Kyverno before 1.19.2 Image Verification Bypass via
      Attestation Type Panic
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.688Z'
---

## Overview

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.

## Affected

- `kyverno < 1.19.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.