Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-122318Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates

High 7.7

In plain English

A high-severity improper certificate validation in kyverno from kyverno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 92.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	0 – before 1.19.2

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

References

GitHub Security Advisory (GHSA-fcfr-fr8g-qjqv) vendor-advisory
VulnCheck Advisory: Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates third-party-advisory