CVE-2022-47633

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.

• CWE-287
• CWE-287

• https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5Patch, Third Party Advisory
• https://github.com/kyverno/kyverno/pull/5713Patch, Third Party Advisory
• https://github.com/kyverno/kyverno/releases/tag/v1.8.5Release Notes, Third Party Advisory
• https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvmPatch, Third Party Advisory
• https://kyverno.io/docs/writing-policies/verify-images/Product
• https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5Patch, Third Party Advisory
• https://github.com/kyverno/kyverno/pull/5713Patch, Third Party Advisory
• https://github.com/kyverno/kyverno/releases/tag/v1.8.5Release Notes, Third Party Advisory
• https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvmPatch, Third Party Advisory
• https://kyverno.io/docs/writing-policies/verify-images/Product

Published

Dec 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4762The Materialis Companion WordPress plugin before 1.3.40 does…5.4
• CVE-2022-47629Libksba before 1.6.3 is prone to an integer overflow vulnera…9.8
• CVE-2022-4763The Icon Widget WordPress plugin before 1.3.0 does not valid…5.4
• CVE-2022-47630Trusted Firmware-A through 2.8 has an out-of-bounds read in …7.4
• CVE-2022-47631Razer Synapse through 3.7.1209.121307 allows privilege escal…7.8
• CVE-2022-47632Razer Synapse before 3.7.0830.081906 allows privilege escala…6.8
• CVE-2022-47634M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 …8.1
• CVE-2022-47635Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.2022121…9.8
• CVE-2022-47636A DLL hijacking vulnerability has been discovered in OutSyst…7.8
• CVE-2022-47637The installer in XAMPP through 8.1.12 allows local users to …6.7
• CVE-2022-4764The Simple File Downloader WordPress plugin through 1.0.4 do…5.4
• CVE-2022-47648An Improper Access Control vulnerability allows an attacker …8.8