PT-2025-12664 · Kyverno · Kyverno

Frgt10Cs · Published 2025-03-24 · Updated 2025-09-12 · CVE-2025-29778

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.14.0-alpha.1

Description Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores the subjectRegExp and issuerRegExp fields when verifying artifact signatures in keyless mode. This allows an attacker to deploy Kubernetes resources with artifacts signed by an unexpected certificate. Deploying these unauthorized Kubernetes resources can lead to a full compromise of the Kubernetes cluster. The vulnerability occurs because Kyverno only checks the subject and issuer fields when verifying signatures, while the subjectRegExp and issuerRegExp fields, intended for more flexible matching, are not considered.

Recommendations Upgrade to Kyverno version 1.14.0-alpha.1 or later to resolve this issue.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-KYVERNO-2025-29778

CVE-2025-29778

GHSA-46MP-8W32-6G94

GO-2025-3562

OPENSUSE-SU-2025:14937-1

Affected Products

Kyverno

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29778.json · Exploit
• 🔥 https://github.com/kyverno/policies/issues/1246 · Exploit
• https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 · Vendor Advisory
• https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 · Patch
• https://osv.dev/vulnerability/BIT-kyverno-2025-29778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29778 · Security Note
• https://osv.dev/vulnerability/GO-2025-3562 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46mp-8w32-6g94 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29778 · Vendor Advisory
• https://github.com/kyverno/kyverno · Note
• https://github.com/kyverno/kyverno/pull/12237 · Note
• https://suse.com/security/cve/CVE-2025-1472 · Note
• https://suse.com/security/cve/CVE-2025-30179 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB · Note