CVE-2025-29778
Kyverno ignores subjectRegExp and IssuerRegExp
- State
- Published
- Severity
- 5.8 Medium
- Published
- Mar 24, 2025
- Updated
- Mar 24, 2025
- Reserved
- Mar 11, 2025
Description
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.8 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N | GitHub_M |
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
kyvernokyverno |
|
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94
- https://github.com/kyverno/policies/issues/1246
- https://github.com/kyverno/kyverno/pull/12237
- https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60
- https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.