Kubewarden trusted-repos-policy: case-sensitive registry match lets a prohibited image past admission

Impact

The policy compares an image's registry hostname against reject lists byte-for-byte, but DNS names are case-insensitive. An image reference written with an uppercase or mixed-case registry host does not match the lowercase entry in the reject list, so admission accepts the workload while the container runtime happily pulls the same blocked image. For an operator who uses Kubewarden to keep untrusted or unvetted images off GPU nodes - the usual control when tenants submit their own inference or training containers - this is a silent bypass of that control; the image lands on an accelerator node with whatever the supply-chain policy was meant to prevent. Allow-list configurations are not bypassable this way (they over-deny instead). Actual exposure depends entirely on what your reject list is protecting against.

Who can reach it

Anyone who can submit a pod or workload manifest to a cluster whose Kubewarden trusted-repos-policy uses reject lists. No special privileges beyond creating workloads; the user supplies the image reference.

What to do

Upgrade trusted-repos-policy to v2.1.2 and re-apply the ClusterAdmissionPolicy / AdmissionPolicy resources; this is a policy module update, no node disruption. Until then, convert reject-list configurations to allow lists, which fail closed, and audit running workloads for image references with non-lowercase registry hostnames.

References

Related entries

• containerd: Unbounded read on OCI image import causes containerd OOMCVE-2023-25153 · containerdMedium
• Kubernetes (kubelet): Unauthenticated node DoS through the kubelet checkpoint API filling node diskCVE-2025-0426 · Kubernetes (kubelet)Medium
• Calico: DeleteCollection skips AuthorizeTierOperation, so a tenant can delete tiered NetworkPolicies theyCVE-2026-41187 · CalicoMedium
• containerd: "ContainerDrip": registry credentials leaked to an attacker-controlled URL referenced in an image manifestCVE-2020-15157 · containerdMedium
• runc: AppArmor bypass when /proc inside the container is symlinked with a specific mount configCVE-2023-28642 · runcMedium
• Cilium: WireGuard transparent encryption not applied to some pod trafficCVE-2024-25630 · CiliumMedium