VULNERABILITY INTELLIGENCE

CVE-2025-29778

CVSS score5.8 MEDIUM

EPSS probability0.34%

CISA KEVNot currently listed

Published2025-03-24

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Weakness classification

security-advisories@github.com: CWE-285

Primary references

security-advisories@github.com — Product
security-advisories@github.com — Patch
security-advisories@github.com — Issue Tracking
security-advisories@github.com — Exploit, Vendor Advisory
security-advisories@github.com — Exploit, Issue Tracking