CVE-2025-29778

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

• CWE-285

• https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537Product
• https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60Patch
• https://github.com/kyverno/kyverno/pull/12237Issue Tracking
• https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94Exploit, Vendor Advisory
• https://github.com/kyverno/policies/issues/1246Exploit, Issue Tracking

Published

Mar 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29771HtmlSanitizer is a client-side HTML Sanitizer. Versions prio…5.3
• CVE-2025-29772OpenEMR is a free and open source electronic health records …6.1
• CVE-2025-29773Froxlor is open-source server administration software. A vul…7.8
• CVE-2025-29774xml-crypto is an XML digital signature and encryption librar…9.3
• CVE-2025-29775xml-crypto is an XML digital signature and encryption librar…9.3
• CVE-2025-29776Azle is a WebAssembly runtime for TypeScript and JavaScript …8.7
• CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.4
• CVE-2025-2978A vulnerability was found in WCMS 11. It has been rated as c…9.8
• CVE-2025-29780Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.8
• CVE-2025-29781The Bare Metal Operator (BMO) implements a Kubernetes API fo…6.5
• CVE-2025-29782WeGIA is Web manager for charitable institutions A Stored Cr…5.4
• CVE-2025-29783vLLM is a high-throughput and memory-efficient inference and…9