BIT-kyverno-2025-29778

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/kyverno/BIT-kyverno-2025-29778.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-kyverno-2025-29778

Aliases

Published

2025-09-12T11:43:02.825Z

Modified

2025-09-15T07:42:05.001778Z

Summary

Kyverno ignores subjectRegExp and IssuerRegExp

Details

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Database specific

{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:go:*:*"
    ]
}

References

Affected packages

Bitnami / kyverno

Package

Name: kyverno
Purl: pkg:bitnami/kyverno

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.14.0-alpha.1