Kyverno: image signature verification accepts certificates with no SAN, bypassing signer pinning

Impact

Kyverno is the admission gate many GPU clusters rely on to ensure only signed images run on expensive nodes. matchCertificateData skips the subject and subjectRegExp checks entirely when the signing certificate carries no Subject Alternative Name, so an attacker who holds any leaf certificate issued by a configured private trust root can sign an arbitrary image, omit the SAN, set the expected Fulcio issuer OID, and have the image admitted as if it matched the pinned signer. The practical result is that a workload image the operator believes is pinned to their build pipeline can be replaced by an attacker-built one that lands on GPU nodes with whatever privileges the workload spec requests. Signature policy failure is quiet: nothing in the cluster reports that the identity check was skipped.

Who can reach it

Network attacker who can push an image reference into a cluster workload and who holds a leaf certificate from one of the trust roots already configured in a verifyImages rule. Requires that credential; no access to the Kyverno controller itself.

What to do

Upgrade Kyverno to 1.19.2 or later and restart the admission controller pods; this is a rolling deployment restart, not a node operation. Until then, review which private trust roots are configured in verifyImages rules and rotate or revoke any leaf certificates from those roots that are not strictly needed, since any one of them is sufficient for the bypass.

References

Related entries

• Docker Engine: docker cp of a compressed archive runs the container's own xz/unpigz with daemon privilegesCVE-2026-41567 · Docker Engine / moby daemon (docker cp archive decompression)High
• Docker / moby: Race condition during `docker cp` mount setup allows escape/host accessCVE-2026-42306 · Docker / mobyHigh
• BuildKit: crafted upload request writes files outside the daemon-controlled state directoryCVE-2026-75593 · BuildKit daemon (build context upload / state directory)High
• Cilium (VLAN interface datapath, TCX attachment): Ingress host policies and L7 network policies silently stop beingNCVD-2026-047-cilium-vlan-interface-datapath-t · Cilium (VLAN interface datapath, TCX attachment)High
• Argo Workflows (Argo Server, HTML artifact serving): A workflow can emit an HTML artifact containing script that, whenCVE-2022-29164 · Argo Workflows (Argo Server, HTML artifact serving)High
• Podman: Incorrect supplementary group handlingCVE-2022-2989 · PodmanHigh