Description
Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kyverno | kyverno | < 1.19.2 | 1.19.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kyverno-1.17 +1 | No fix yet | — |
Advisories 1
- WID-SEC-2026-4096 Kyverno: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
References
- GitHub Security Advisory (GHSA-24cc-9745-hxfc) vendor-advisory
- VulnCheck Advisory: Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic third-party-advisory