Summary
Kyverno's verifyImages feature caches prior verification results using a cache key that includes the image reference string (such as a tag) but does not bind the cache entry to the verified digest. On a cache hit, (*ImageVerifier).Verify returns a pass response without re-running signature or attestation verification. The mutateDigest function can then resolve the current digest for the tag and patch it into the admitted resource. This enables a "verify A, run B" attack chain: verify a signed digest for a tag once to warm the cache, then move the tag to a different digest, causing subsequent admissions to succeed from cache while pinning the new unverified digest.
Impact
This is an admission-time integrity bypass. An attacker who can reference a tag in a workload and move that tag in a registry can cause Kyverno to admit and pin an unverified digest under a verifyImages policy. The attack requires a cluster to use a verifyImages policy that matches an image tag (not a pinned digest) with the default image verification cache enabled. A signed image is admitted once to warm the cache, the tag is then moved to an unsigned or malicious image, and subsequent admissions of the same tag succeed from cache without re-verification. The admitted resource is patched with the current (malicious) digest by mutateDigest.
Detection
There is no public Falco rule or specific log pattern documented for this advisory. Review Kyverno admission controller audit logs for admission decisions recording "verified from cache" against tag-based image references. Monitor workloads for unexpected image digest changes after initial admission. Restrict verifyImages policies to digest-pinned image references rather than tags; tag-based references cannot provide independent verification assurance when caching is enabled.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which addresses the cache key binding issue by incorporating the verified digest into the cache entry. Until the upgrade is complete, configure verifyImages policies to reference images by digest rather than tag to prevent cache-based bypasses. Alternatively, set useCache: false in affected verifyImages policies to disable caching and force re-verification on every admission request.