Kyverno: non-string attestation `type` field panics image verification, bypassing signature checks

Impact

An attacker who can push an OCI referrer manifest with a non-string type field crashes Kyverno's attestation parsing. The consequence is worse than a crash: under failurePolicy: Ignore the image-verification policy is skipped and an unverified image is admitted, and the reports-controller can be driven into a crash loop so the cluster loses its policy reporting as well. On a GPU fleet image verification is often the only control standing between a tenant-supplied container and a node holding /dev/nvidia* devices, model weights and shared fabric credentials, so a verification bypass means an unattested image can be scheduled onto a node you cannot cheaply drain.

Who can reach it

Anyone who can publish a referrer artifact in a registry that Kyverno consults - an attacker with push access to the registry, or control of any registry path a verification policy points at. NVD records the vector as unauthenticated (PR:N).

What to do

Upgrade Kyverno to 1.19.2 or later, which is an image bump plus a restart of the admission and reports controllers - no node drain. In the meantime, treat failurePolicy: Ignore on image-verification policies as an open door and consider switching those specific policies to Fail, accepting that a crash then blocks admission instead of waving images through. Also restrict which registries and referrer paths verification policies will fetch from.

References

Related entries

• Kyverno: In/NotIn operators panic on non-string JMESPath arrays, crashing admission controlCVE-2026-122319 · Kyverno policy engine (`In` / `NotIn` operator JMESPath value handling)High
• Kyverno: unbounded decompression of attestation predicate layers OOM-kills the admission controllerCVE-2026-122322 · Kyverno attestation verification (extractStatement gzip predicate layer decompression)High
• Kyverno: unbounded decompression of notary signature layers exhausts admission controller memoryCVE-2026-122323 · Kyverno notary verification (FetchSignatureBlob gzip signature layer decompression)High
• Kyverno: namespaced tenants can template generate rules to write resources into any namespaceCVE-2026-124441 · Kyverno background-controller (generate rule target templating)High
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh