{"id":"EM-20261105-V4JU","url":"https://cyber.eventmonitor.net/incident/EM-20261105-V4JU/kyverno-vulnerability-cve-2026-122315/","type":"cve","title":"Kyverno Vulnerability (CVE-2026-122315)","subtitle":"CVE-2026-122315","subject":"CVE-2026-122315","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T03:17:24.200Z","firstSignal":"2026-11-05T02:25:16.000Z","lastSignal":"2026-11-05T03:17:24.200Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T03:17:24.200Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T03:17:24.200Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T02:25:16.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T03:17:24.200Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-V4JU created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T03:17:24.200Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T03:17:24.200Z","detail":"CVSS 8.7 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T02:25:16.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T02:25:16.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-122315 (important)","text":"github.com/kyverno/kyverno: Kyverno: Denial of Service via crafted attestation statements","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-122315.json"},{"at":"2026-11-05T03:17:24.200Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-122315 (CVSS 8.7)","text":"Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122315"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T03:17:24.200","score":8.7,"severity":"HIGH","desc":"Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under…","product":"","seen":1793900599849},"kev":null,"epss":{"epss":0.00402,"pct":0.34593,"at":1793967405734},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}