What’s Vulnerable › Vulnerabilities

CVE-2025-29778: Kyverno ignores subjectRegExp and IssuerRegExp

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-24 · updated 2026-06-17
• Weakness: CWE-285

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Affected products

• kyverno: from 1.13.0 before 1.13.6 — fixed in 1.13.6

How to fix

Upgrade to a fixed version: kyverno 1.13.6. Check the vendor advisory for mitigations.

References

• https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537
• https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60
• https://github.com/kyverno/kyverno/pull/12237
• https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94
• https://github.com/kyverno/policies/issues/1246

Get alerted when CVE-2025-29778 or the next vulnerability affects your stack