CVE-2025-29778

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-29778
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

8.0 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 Patch
https://github.com/kyverno/kyverno/pull/12237 Issue Tracking
https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 Exploit Vendor Advisory
https://github.com/kyverno/policies/issues/1246 Exploit Issue Tracking
https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*
History

01 Aug 2025, 13:10

Type Values Removed Values Added
First Time Kyverno kyverno
Kyverno
CPE cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*
References () https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 - () https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 - Product
References () https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 - () https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 - Patch
References () https://github.com/kyverno/policies/issues/1246 - () https://github.com/kyverno/policies/issues/1246 - Exploit, Issue Tracking
References () https://github.com/kyverno/kyverno/pull/12237 - () https://github.com/kyverno/kyverno/pull/12237 - Issue Tracking
References () https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 - () https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 - Exploit, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.0

24 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-24 17:15

Updated : 2025-08-01 13:10

NVD link : CVE-2025-29778

Mitre link : CVE-2025-29778

JSON object : View

Products Affected

kyverno

  • kyverno
CWE
CWE-285

Improper Authorization