Summary
An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue requires the attacker to compromise the registry that Kyverno fetches images from. The attacker could then return a vulnerable image to the user and leverage that to further escalate their position. The attacker would need to know which images the Kyverno user consumes and know of one of multiple exploitable vulnerabilities in previous digests of those images, or — if the registry is fully compromised — craft a malicious image with a different digest with intentionally placed vulnerabilities and deliver it.
An attacker was not able to control parameters of the image other than the digest. Users pulling images from trusted registries are not impacted. There is no evidence of exploitation in the wild.
Impact
The bug is in Kyverno's image digest handling — distinct from CVE-2023-46737, which is in Cosign and produces a different impact (denial-of-service via endless-data response). Here, the result is silent substitution of a different digest, which can lead to consumption of a vulnerable or attacker-crafted image even when the user thinks they are pulling a known-good tag.
Detection
Audit Kyverno policies that resolve image digests via the verifyImages or context-loading paths. Cross-reference the resolved digests with the digests returned directly from a trusted client (e.g., crane digest) and treat any divergence as a signal. Operators with mirroring registries or running their own should treat registry compromise as the prerequisite — investigate registry access logs for unexpected pushes or pulls during the affected period.
Mitigation
Upgrade Kyverno to v1.10.5 or v1.11.0 or later. The vulnerability was found during a CNCF-funded security audit by Ada Logics (facilitated by OSTIF).
Workarounds: pull only from trusted registries, pin images by digest end-to-end (so any swap is detectable downstream), and pair Kyverno's verifyImages with Cosign signature verification rather than relying on digest checks alone.