Vulnerability · Published Mar 24, 2025 · Assigned by GitHub_M

CVE-2025-29778Kyverno ignores subjectRegExp and IssuerRegExp

Medium 5.8

In plain English

A medium-severity security flaw in kyverno from kyverno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kyverno/kyverno	1.14.0-alpha.1	GHSA-46mp-8w32-6g94
Go	github.com/kyverno/kyverno	1.14.0-alpha.1	GO-2025-3562

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	< 1.14.0-alpha.1

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

References

https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 x_refsource_CONFIRM
https://github.com/kyverno/policies/issues/1246 x_refsource_MISC
https://github.com/kyverno/kyverno/pull/12237 x_refsource_MISC
https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 x_refsource_MISC
https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 x_refsource_MISC