CVE-2025-29778

high

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

References

https://github.com/kyverno/policies/issues/1246

https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94

https://github.com/kyverno/kyverno/pull/12237

https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60

https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7996

Details

Source: Mitre, NVD

Published: 2025-03-24

Updated: 2025-08-01

Named Vulnerability: GO-2025-3562Named Vulnerability: GHSA-46mp-8w32-6g94

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 8

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00343