CVE-2025-29778 — Vulnetix

CVE-2025-29778 PUBLISHED

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0 contains a patch for the issue.

EPSS 0.08% · 24.4th percentile

Risk Scores

EPSS Score

0.08%

24.4th percentile

Affected Products

Vendor	Product	Versions
Bitnami	kyverno	0
Bitnami	kyverno	0

Exploit Intelligence

https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94 (nist-nvd)
https://github.com/kyverno/policies/issues/1246 (nist-nvd)
CIRCL seen: CVE-2025-29778 (circl-sighting)
CIRCL seen: CVE-2025-29778 (circl-sighting)
https://github.com/kyverno/kyverno/pull/12237 (circl)
https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60 (circl)
https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537 (circl)

Timeline

Jan 21, 1970 Fix PR Merged
Jan 21, 1970 Security Advisory
Mar 24, 2025 CVE Published
Mar 24, 2025 PoC Published
Mar 24, 2025 PoC Published
Mar 25, 2025 EPSS Score
Mar 25, 2025 Coalition ESS Score
Mar 28, 2025 Coalition ESS Score
Apr 7, 2025 EPSS Score
Apr 20, 2025 EPSS Score
May 3, 2025 EPSS Score
May 8, 2025 CVE Updated

References

Open in Interactive Console →