CVE-2025-29778
published 2025-03-24CVE-2025-29778: Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and…
PriorityP342high8CVSS 3.1
AVNACHPRHUINSCCHIHAH
EPSS
0.32%
23.4th percentile
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | kyverno_kyverno | >= 0 < 1.14.0-alpha.1 | 1.14.0-alpha.1 |
| github.com | kyverno_kyverno | >= 1.13.0 < 1.14.0-alpha.1 | 1.14.0-alpha.1 |
| kyverno | kyverno | < 1.14.0-alpha.1 | 1.14.0-alpha.1 |
| kyverno | kyverno | >= 1.13.0 < 1.13.6 | 1.13.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
osv·2025-03-25
CVE-2025-29778 Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
GHSA
Kyverno ignores subjectRegExp and IssuerRegExp
ghsa·2025-03-24
CVE-2025-29778 [MEDIUM] CWE-285 Kyverno ignores subjectRegExp and IssuerRegExp
Kyverno ignores subjectRegExp and IssuerRegExp
### Summary
Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate.
### Details
Kyverno checks only subject and issuer fields when verifying an artifact's signature: https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537. While there are subjectRegExp and issuerRegExp fields that can also be used for the defining expected subject and issue values. If the last ones are used then their values are not taken in count and there is no actually restriction for the certificate that was used for the image sign.
### PoC
For the successful e
OSV
Kyverno ignores subjectRegExp and IssuerRegExp
osv·2025-03-24
CVE-2025-29778 [MEDIUM] Kyverno ignores subjectRegExp and IssuerRegExp
Kyverno ignores subjectRegExp and IssuerRegExp
### Summary
Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate.
### Details
Kyverno checks only subject and issuer fields when verifying an artifact's signature: https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537. While there are subjectRegExp and issuerRegExp fields that can also be used for the defining expected subject and issue values. If the last ones are used then their values are not taken in count and there is no actually restriction for the certificate that was used for the image sign.
### PoC
For the successful e
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60https://github.com/kyverno/kyverno/pull/12237https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94https://github.com/kyverno/policies/issues/1246
2025-03-24
Published