Kyverno verifyImages evaluates a mutable tag with useCache enabled. A successful verification warms the cache; an attacker able to move that tag and submit a workload can then reference different content under the same tag. The advisory lists 1.18.0 through 1.19.1 as affected.
What is fixed
Kyverno lists 1.19.2 as patched. That release is publicly available; this publication does not re-run the exploit against it.
What to do
Upgrade to Kyverno 1.19.2. Until upgraded, disable the image verification cache for affected rules with useCache: false and use digest-pinned image references.
By when
∅not recorded No remediation deadline is specified in the public advisory.
Does not claim: The bypass requires a warmed cache, a mutable image reference and attacker control of the tag; the advisory does not establish a bypass for immutable digest references. All 2 limits
Main mark: ◌claimed · it rates claim c2, not the record as a whole · Scope: Kyverno image verification in the stated admission-controller and registry conditions.
Portfolio updated: 21 Oct 2026 (the last edit of this record set, not a re-check of every upstream source). Status, releases and attribution belong to each source below; none is inferred from another record.
✓verifiedKyverno published GHSA-2r43-6962-xcw5 on 2026-10-21, rates it CRITICAL (CVSS 3.1: 9.1), lists 1.19.2 as patched, and credits @1seal as reporter.verified · Public advisory page and structured GitHub metadata checked on 2026-10-21. · Kyverno advisory ↗ (external)#c1
◌claimedAt the reported commit, the cache key includes policy identity, resource version, rule name and image reference, but no verified digest. A cache hit skips verification; digest mutation can then resolve and pin the tag's new, unverified digest.claimed · Mechanism documented in the published report; the original reproduction is not re-run for this website update. · Published technical report ↗ (external)#c2
Marks: ✓ verified · ◌ claimed · ✕ contradicted · ∅ not recorded. Where a source exists, it is linked; 1seal does not control it.
What this record does not claim
The bypass requires a warmed cache, a mutable image reference and attacker control of the tag; the advisory does not establish a bypass for immutable digest references.
No exploitation in production or independent retest of the released fix is established by this website update.
Published2026-10-21Added the public Kyverno advisory, source-bound severity and fix metadata, reporter credit and operator guidance. No CVE assigned in this snapshot.
Upstream fixed versions: package name not specified: 1.19.2
patched
details
Finding IDs
F-KYVERNO-VERIFYIMAGES-CACHE-001
GHSA
GHSA-2r43-6962-xcw5
Status
patched
CWE
CWE-367
Fixed in
1.19.2
Recorded credit
@1seal: reporter (accepted upstream credit). Fixes are maintained by Kyverno; 1seal patch authorship is not claimed.
Disclosure date
Note
The advisory lists 1.18.0 through 1.19.1 as affected. Kyverno verifyImages evaluates a mutable tag with useCache enabled. A successful verification warms the cache; an attacker able to move that tag and submit a workload can then reference different content under the same tag. At the reported commit, the cache key includes policy identity, resource version, rule name and image reference, but no verified digest. A cache hit skips verification; digest mutation can then resolve and pin the tag's new, unverified digest. Upgrade to Kyverno 1.19.2. Until upgraded, disable the image verification cache for affected rules with useCache: false and use digest-pinned image references. No CVE identifier is assigned in the public advisory snapshot checked on 2026-10-21.
Recorded severity
critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
CVSS assessment
Kyverno public GitHub advisory; v3.1; 9.1; observed 2026-10-21
Upstream title
[CRITICAL 9.1] kyverno verifyimages caches prior verification results using a cache key that includes the image reference string (for example, a tag) but does not bind the cache
Upstream CWE
CWE-367
Upstream publication
Upstream updated
Metadata fetched
Upstream fixed versions
package name not specified: 1.19.2
Upstream affected ranges
package name not specified: >= 1.18.0 and <= 1.19.1
Upstream @1seal credit
@1seal: reporter (accepted)
F-KYVERNO-VERIFYIMAGES-CACHE-001: Verification failures. A cached signature or attestation result is not bound to the immutable digest subsequently admitted. Reviewed 21 Oct 2026. Mechanism assessed by 1seal.
Security area (1seal assessment): Integrity. A cached signature or attestation result is not bound to the immutable digest subsequently admitted. Reviewed 21 Oct 2026.
This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.
Paper copy does not update. Current version: 1seal.org/research/findings/F-KYVERNO-VERIFYIMAGES-CACHE-001/