Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-29778

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Published

2025-03-24T17:15:20.970

Last Modified

2025-08-01T13:10:56.737

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-285

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	kyverno	kyverno	< 1.13.6	Yes

References

https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 Product ([email protected])
https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 Patch ([email protected])
https://github.com/kyverno/kyverno/pull/12237 Issue Tracking ([email protected])
https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 Exploit, Vendor Advisory ([email protected])
https://github.com/kyverno/policies/issues/1246 Exploit, Issue Tracking ([email protected])