VDB
CVE-2025-29778
CVE-2025-29778
PUBLISHED
CVSS 8 HIGH
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0 contains a patch for the issue.
EPSS 0.34% · 24.8th percentile
Risk Scores
CVSS 3.1
8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.34%
24.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | kyverno | 0 |
| Bitnami | kyverno | 0 |
Timeline
- Jan 21, 1970 Fix PR Merged
- Jan 21, 1970 Security Advisory
- Mar 24, 2025 CVE Published
- Mar 24, 2025 PoC Published
- Mar 24, 2025 PoC Published
- Mar 25, 2025 EPSS Score
- Mar 25, 2025 Coalition ESS Score
- Mar 28, 2025 Coalition ESS Score
- Apr 8, 2025 EPSS Score
- Apr 21, 2025 EPSS Score
- May 5, 2025 EPSS Score
- May 8, 2025 CVE Updated
References
- https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 fix
- https://github.com/kyverno/policies/issues/1246 discussion
- https://github.com/kyverno/kyverno/pull/12237 fix
- https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 url
- https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-29778 url