No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 05 Nov 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- Analysis, summary and remediation
- © VulnCrest