Skip to main content

Improper Authorization

CVE-2025-29778

High
8/10

Summary

Kyverno is a policy engine designed for cloud native platform engineering teams. The github.com/kyverno/kyverno package versions prior to version 1.13.6, ignores "subjectRegExp" and "IssuerRegExp" while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with artifacts that were signed by an unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of the kubernetes cluster.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published