Description

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource rather than only for the listed images or values, so an exception intended to exempt a single trusted image exempts every image on the matched resource(s). As a result, unsigned or untrusted images can be admitted to the cluster without signature verification. This differs from ValidatingPolicy, GeneratingPolicy, and MutatingPolicy, which treat the same field as a partial exemption. The issue is fixed in version 1.19.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-26T14:16:55.563Z",
  "pubdate": "2026-09-26T14:16:55.563Z",
  "executiveSummary": "Kyverno versions 1.14.0 through 1.19.0 contain a critical vulnerability in the ImageValidatingPolicy evaluator. The flaw arises from an incorrect implementation of PolicyException logic, where the controller fails to parse the 'spec.images' and 'spec.allowedValues' fields for image validation rules.\nThis vulnerability constitutes an improper authorization and security control bypass. When a PolicyException is configured to exempt a specific trusted image from signature verification, the Kyverno engine erroneously applies a blanket exemption to the entire resource. Consequently, all images contained within a matched resource—including unsigned, malicious, or untrusted artifacts—are admitted into the Kubernetes cluster, effectively neutralizing image verification policies.\nThe risk is substantial, as it allows attackers to bypass supply chain security controls, potentially leading to the deployment of unauthorized container images. Exploitation does not require elevated cluster permissions beyond those necessary to trigger a resource evaluation against an existing PolicyException. This vulnerability significantly weakens the integrity of container admission control within affected environments.",
  "technicalDetails": "The vulnerability resides within the Kyverno admission controller's logic for processing ImageValidatingPolicy (policies.kyverno.io/v1beta1) objects. The root cause is an implementation discrepancy where the evaluator ignores specific exemption constraints provided in the PolicyException custom resource.\nIn the affected versions (1.14.0 to 1.19.0), the controller fails to parse and enforce the 'spec.images' and 'spec.allowedValues' fields during the admission request phase. While ValidatingPolicy, GeneratingPolicy, and MutatingPolicy controllers correctly process these fields to implement granular, partial exemptions, the ImageValidatingPolicy controller treats a PolicyException as an unconditional override for all image validation logic associated with the matched resource.\nThe attack flow proceeds as follows: 1) An attacker identifies an existing PolicyException that references a workload within a specific namespace. 2) The attacker submits a deployment or pod specification to the Kubernetes API server that matches the 'policyRefs' and 'matchConditions' defined in the PolicyException. 3) Upon intercepting the request, the Kyverno admission controller evaluates the resource against the policy. 4) Due to the flawed implementation, the controller detects a matching PolicyException and terminates the signature verification process entirely for the entire pod spec.\nAs a result of this logic error, the policy engine fails to differentiate between the intended exempted image and other images defined in the pod manifest. An attacker can append arbitrary, unsigned, or malicious images to a pod spec alongside an exempted image, causing the admission controller to admit the entire payload without verifying image provenance or signatures. This bypasses the cryptographically enforced security gates intended to ensure container image integrity.\nThe vulnerability requires no special authentication beyond the ability to submit resource requests that trigger the admission controller. The exploitation is passive from the attacker's perspective, as the system incorrectly validates the request based on the flawed policy evaluation state. There is no requirement for network-level access beyond the API server reachability, and the impact is a total loss of container image trust within the affected namespaces."
}