CVE-2025-29778

Severity CVSS v4.0:

Pending analysis

Type:

CWE-285 Improper Authorization

Publication date:

24/03/2025

Last modified:

01/08/2025

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact&#39;s sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 5.80 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): None
Integrity (I): High
Availability (A): None