Summary
Kyverno's ClusterPolicy image verification relies on a kyverno.io/verify-images-scoped annotation to pass verification results from the mutating webhook to the validating webhook. Kubernetes does not restrict users from setting kyverno.io/-prefixed annotations, and Kyverno does not strip user-provided annotations before the validating webhook reads them. When the mutating webhook does not set this annotation — either because the policy has no attestors/attestations (causing verifyImage() to return without setting metadata) or because the mutating webhook is skipped under failurePolicy: Ignore — the user's pre-supplied forged annotation persists and the validating webhook trusts it, admitting unsigned images. The ivpol (CEL ImageValidatingPolicy) path was separately fixed by re-verifying images in the validating webhook; the ClusterPolicy path was not given the same treatment.
Impact
An attacker who can submit a workload resource can include a forged kyverno.io/verify-images-scoped annotation that mimics a successful verification result. In clusters where the mutating webhook does not set this annotation — due to policies with no attestors configured, or due to mutating webhook timeout with failurePolicy: Ignore — the validating webhook trusts the forged value and admits unsigned or maliciously-tagged container images. This breaks supply chain integrity enforcement and allows unsigned images to run in clusters that rely on Kyverno ClusterPolicy verifyImages rules.
Detection
Review all Kyverno ClusterPolicy resources that use verifyImages rules and check whether attestors or attestations fields are populated. Policies with no attestors configured do not set the kyverno.io/verify-images-scoped annotation during the mutate phase, leaving the validating phase reliant entirely on user-supplied annotation values. Inspect admission requests for workloads in audit mode (audit-annotations in the Kyverno configuration) for unexpected values of the kyverno.io/verify-images-scoped annotation. Review failurePolicy settings on the Kyverno mutating webhook and consider whether timeout scenarios create an exploitable window.
Mitigation
Upgrade Kyverno to version 1.19.2 or later. As an interim measure for clusters that cannot immediately upgrade, ensure that all verifyImages rules in ClusterPolicy resources include attestors or attestations fields so that the mutating webhook always sets the kyverno.io/verify-images-scoped annotation from a trusted source. Set failurePolicy: Fail on the Kyverno mutating webhook to prevent scenarios where the webhook is bypassed on timeout. Do not rely solely on the kyverno.io/verify-images-scoped annotation as the validation signal in affected versions.