Kyverno: a PolicyException meant to exempt one image disables image signature verification for the whole resource

Impact

The ImageValidatingPolicy evaluator in Kyverno 1.14.0 through 1.19.0 never reads spec.images or spec.allowedValues on a PolicyException. Any exception whose policyRefs and matchConditions match a resource turns off image signature verification for that entire resource instead of only the listed images, which is the opposite of how ValidatingPolicy, GeneratingPolicy and MutatingPolicy treat the same field. The practical result is that the narrow carve-out a platform team wrote for one trusted image silently admits every unsigned or untrusted image in the same pod spec - sidecars, init containers, a swapped model-server image. For a GPU fleet this is the admission gate that is supposed to keep unreviewed CUDA and inference images off the nodes, and it fails open without any error to notice. Exploitation is not required; a normal, correct-looking exception is enough.

Who can reach it

Any tenant or pipeline able to deploy workloads covered by an existing PolicyException, or able to create one, can ship unsigned images. Authenticated, namespace-level Kubernetes access; no cluster-admin needed.

What to do

Upgrade Kyverno to 1.19.1 or later and restart the admission controller. Before or alongside that, audit every PolicyException that references an ImageValidatingPolicy and narrow its matchConditions so the exemption covers only the intended resources, then review which images were actually admitted while an affected version ran - the gap leaves no distinct log entry, so treat unsigned images already running as unverified. Controller rollout only; no node work.

References

Related entries

• Kyverno: legacy apiCall path skips the egress blocklist, allowing SSRF to cloud metadata from the admission controllerCVE-2026-100705 · Kyverno admission controller (legacy apiCall service executor / GlobalContextEntry)High
• Kyverno: percent-encoded dot-segments in apiCall urlPath bypass namespace scoping in namespaced PoliciesCVE-2026-100707 · Kyverno admission controller (namespaced Policy apiCall urlPath validation)High
• Kyverno: self-referential variable templates hang the admission webhook, blocking cluster-wide admissionCVE-2026-122305 · Kyverno admission controller (variable substitution)High
• Kyverno: pathological wildcard patterns in policy match/exclude names pin admission controller coresCVE-2026-122306 · Kyverno admission controller (ValidateMatchExcludeConflict wildcard matching)High
• Kyverno: namespaced PolicyExceptions fold into generated ValidatingAdmissionPolicies, bypassing enforcementCVE-2026-122307 · Kyverno admissionpolicygenerator controller (PolicyException handling)High
• Kyverno: APICall URLPath query string defeats the namespace regex, reading cluster-scoped resourcesCVE-2026-122312 · Kyverno APICall Fetch() (pkg/engine/apicall/apiCall.go URLPath validation)High