{"id":"CVE-2026-122318","kind":"vulnerability","aliases":["CVE-2026-122318"],"related":[],"title":"Kyverno: image signature check skips subject when certificate lacks SAN","description":"Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.","summary":"Kyverno's verifyImages rule skips its subject and subjectRegExp checks when a signing certificate has no Subject Alternative Name. An attacker holding a leaf certificate from a configured private trust root can sign malicious images that are admitted despite signer pinning.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-verification","infrastructure","kubernetes","kyverno"],"not_affected_if":["kyverno-1.19.2-or-later","no-verifyimages","public-trust-root-only"],"how_to_check":"- Check the Kyverno version running in the cluster, for example with `kubectl get deploy -n kyverno -o wide`, and compare it to `1.19.2`.\n- Look for ClusterPolicy or Policy resources that use verifyImages with attestors or keys that rely on a private trust root and subject or subjectRegExp checks.","fix":"- Kyverno: move to `1.19.2` or later.","status":"open","published_at":"2026-11-05T03:17:24+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","triaged_at":"2026-11-05T03:33:35+00:00","updated_at":"2026-11-05T03:33:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T03:33:35Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: move to `1.19.2` or later.","reach":"network","title":"Kyverno: image signature check skips subject when certificate lacks SAN","impact":"high","summary":"Kyverno's verifyImages rule skips its subject and subjectRegExp checks when a signing certificate has no Subject Alternative Name. An attacker holding a leaf certificate from a configured private trust root can sign malicious images that are admitted despite signer pinning.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","kyverno","image-verification"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Malicious container images get admitted and run in the cluster","analyst_note":"","how_to_check":"- Check the Kyverno version running in the cluster, for example with `kubectl get deploy -n kyverno -o wide`, and compare it to `1.19.2`.\n- Look for ClusterPolicy or Policy resources that use verifyImages with attestors or keys that rely on a private trust root and subject or subjectRegExp checks.","plain_action":"","needs_analyst":false,"not_affected_if":["no-verifyimages","public-trust-root-only","kyverno-1.19.2-or-later"],"who_is_affected":"Clusters running Kyverno before 1.19.2 that use verifyImages with a private trust root and subject-based signer pinning are exposed. An attacker must already hold a leaf certificate issued from that trust root. Clusters that do not verify image signatures with Kyverno, or that use only public trust roots, are not affected by this flaw as described.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001076,"input_tokens":4301,"output_tokens":1291,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122318':13A,16A '-2026':12A,15A '1.19.2':66C 'admit':60B,116C 'altern':40B,87C 'attack':43B,89C 'authent':69C 'bypass':70C 'certif':8A,36B,47B,83C,93C 'check':4A,32B,79C 'configur':50B,96C 'contain':67C 'cve':11A,14A 'despit':61B,117C 'expect':106C 'fulcio':107C 'hold':44B,90C 'imag':2A,18B,57B,113C 'image-verif':17B 'infrastructur':20B 'issuer':108C 'kubernet':21B 'kyverno':1A,22B,23B,64C 'lack':9A 'leaf':46B,92C 'malici':56B,112C 'matchcertificatedata':72C 'name':41B,88C 'oid':109C 'omit':101C 'pin':63B,119C 'privat':51B,97C 'root':53B,99C 'rule':26B 'san':10A,103C 'set':104C 'sign':35B,55B,82C,111C 'signatur':3A 'signer':62B,118C 'skip':5A,27B,74C 'subject':6A,29B,39B,76C,86C 'subjectregexp':31B,78C 'trust':52B,98C 'verif':19B 'verifyimag':25B,75C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno before 1.19.2 that use verifyImages with a private trust root and subject-based signer pinning are exposed. An attacker must already hold a leaf certificate issued from that trust root. Clusters that do not verify image signatures with Kyverno, or that use only public trust roots, are not affected by this flaw as described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imageverification","infrastructure","kubernetes","kyverno"],"campaign_type":null,"first_public_at":"2026-10-21T15:56:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122318","severity":null,"published_at":"2026-11-05T03:17:24+00:00","modified_at":"2026-11-05T03:17:24+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","fetched_at":"2026-11-05T03:31:42+00:00","note":null}],"documents":[{"id":72716,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T15:56:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72717,"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}