Kyverno verifyImages: cache keyed by tag, not digest, lets a moved tag admit an unverified image

Impact

verifyImages caches signature and attestation results under the image reference string rather than the digest it actually verified, so a cache hit skips verification entirely. An attacker who can push to a registry repository and submit a workload can warm the cache with a legitimately signed image, repoint the tag to an unsigned image, and have Kyverno admit it - then mutateDigest pins the unverified digest, which makes the result look like a properly attested deployment. For a GPU fleet this defeats the control that is supposed to guarantee only vetted inference, training and CUDA base images run; arbitrary code lands on nodes holding GPU devices and fleet credentials, with the admission record asserting the opposite. Separate from the authorization bypasses in CVE-2026-122308 and CVE-2026-122316, which share the same fixed version but are different code paths.

Who can reach it

An authenticated user able to submit workloads, plus the ability to move a tag in a registry repository the cluster pulls from (a compromised CI push credential is enough). No cluster-admin access required.

What to do

Upgrade Kyverno to 1.19.2 or later (affected 1.18.0 onward): controller image bump and Deployment rollout, no node disruption. Pin workloads to digests rather than tags so a moved tag cannot change what runs, and make registry repositories immutable where the registry supports it. Re-verify the digests currently running against your signing policy - images admitted through a stale cache entry will not be caught retroactively.

References

Related entries

• LXD: crafted image templates escape the instance template directory and read or create host filesCVE-2026-16033 · LXD (image metadata template handling, QEMU/VM driver paths)High
• RHACM cluster-proxy: caller-supplied impersonation headers grant cluster-admin on managed clustersCVE-2026-17107 · Red Hat ACM / multicluster-engine cluster-proxy (service-proxy impersonation headers)High
• Argo Workflows (workflow executor, artifact driver logging): The executor logs the whole artifact driver struct, so S3CVE-2026-42295 · Argo Workflows (workflow executor, artifact driver logging)High
• Argo Workflows (Argo Server, ConfigMap-backed sync limit provider): The Sync Service's ConfigMap provider runs noCVE-2026-42297 · Argo Workflows (Argo Server, ConfigMap-backed sync limit provider)High
• KubeVela: a ComponentDefinition can point terraform.path at a symlink and OOM-kill the cluster-wide controllerCVE-2026-55108 · KubeVela vela-core controller (Terraform remote configuration loader, GetTerraformConfigurationFromRemote)High
• CloudNativePG: managed-role passwords exposed via pg_stat_statements, enabling command execution in the DB podCVE-2026-55765 · CloudNativePG operator (managed-role password handling)High