CVE-2026-122315
Description
A flaw was found in Kyverno. An unauthenticated remote attacker can cause a Denial of Service (DoS) by supplying a crafted attestation statement containing an unexpected data type in an Open Container Initiative (OCI) manifest. Processing this payload triggers an internal application crash that halts the policy engine and can allow unverified images to bypass verification under permissive failure settings.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote party can cause policy engine crashes that degrade cluster availability and potentially bypass admission verification controls. When admission webhooks are configured with permissive failure policies, crashing the engine allows unverified container images to be admitted into production environments. Red Hat OpenShift does not ship Kyverno as a core component by default, meaning default platform installations are not directly exposed unless community or custom Kyverno deployments are utilized.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to safely handle attestation type fields in buildStatementMap using guarded type checks to prevent admission controller panics: upgrade to Kyverno 1.19.2+ (or the corresponding fixed Red Hat builds), which implement a comma-ok type check to ignore malformed statements and normalize the type field to a string, closing all 2 injection vectors (OCI referrer manifest with non-string type field, crafted attestation statement). Until patched, this is a concern on Environments using Kyverno to verify image attestations or process OCI referrers, so Restrict registry write permissions to prevent untrusted parties from pushing unverified container images or OCI referrer manifests. These controls limit blast radius and contain exploitation, but they do not fix the underlying unchecked type assertion defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
