← Back

CVE-2025-29778

nvd nist
Published: Mar 24, 2025Modified: Aug 1, 2025

JSON object

Loading...
8.0
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability: 1.3 / Impact: 6.0
Source: NVD

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Affected (1)

Products: Kyverno: Kyverno
Kyverno
1 product
Kyverno
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Kyverno
From 1.13.0 to 1.13.6

Related CWEs

CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (5)

Source: security-advisories@github.com
Product
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue Tracking
Source: security-advisories@github.com
ExploitVendor Advisory
Source: security-advisories@github.com
ExploitIssue Tracking

Timeline

No history available yet.