Live › vulnerability › CVE-2026-63121
The trusted-repos-policy in Kubewarden policies compares image registry hostnames case-sensitively, though DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can slip past a reject-list rule, so a prohibited image gets admitted to the cluster.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Teams running Kubernetes clusters with the Kubewarden trusted-repos-policy configured with reject lists are exposed; allow-list-only configurations fail closed and are not bypassed. The bypass depends on the configured rejection policy and deployment environment. Teams not using this policy, or using only allow lists, can skip it.
No product ranges from the sources yet.
ClusterAdmissionPolicy objects.2.1.2.2.1.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though registry DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-63121")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.