CVE-2025-29778 | THREATINT

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

PUBLISHED Reserved 2025-03-11 | Published 2025-03-24 | Updated 2025-03-24 | Assigner GitHub_M

MEDIUM: 5.8CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Problem types

CWE-285: Improper Authorization

Product status

< 1.14.0-alpha.1

affected

References

github.com/...yverno/security/advisories/GHSA-46mp-8w32-6g94

github.com/kyverno/policies/issues/1246

github.com/kyverno/kyverno/pull/12237

github.com/...ommit/8777672fb17bdf252bd2e7d8de3441e240404a60

github.com/...3140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go

cve.org (CVE-2025-29778)

nvd.nist.gov (CVE-2025-29778)

Download JSON