CVE-2025-29778

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-29778
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-29778.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-29778
Aliases
Downstream
Related
Published
2025-03-24T16:38:08.104Z
Modified
2026-02-10T06:37:01.774240Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Kyverno ignores subjectRegExp and IssuerRegExp
Details

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29778.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ]
}
References

Affected packages

Git / github.com/kyverno/kyverno

Affected ranges

Type
GIT
Repo
https://github.com/kyverno/kyverno
Events
Introduced
978c2f3b56df37a8bea4ee649369efaea53a684b
Fixed
1d276d71bc62d2ec17184f80821fbead34d6aff7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-29778.json"