CVE-2026-100704

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource rather than only for the listed images or values, so an exception intended to exempt a single trusted image exempts every image on the matched resource(s). As a result, unsigned or untrusted images can be admitted to the cluster without signature verification. This differs from ValidatingPolicy, GeneratingPolicy, and MutatingPolicy, which treat the same field as a partial exemption. The issue is fixed in version 1.19.1.

• CWE-863

• https://github.com/kyverno/kyverno/security/advisories/GHSA-5cjf-wwfg-pj4c
• https://www.vulncheck.com/advisories/kyverno-before-1.19.1-imagevalidatingpolicy-exception-bypass

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1007Incorrect Authorization vulnerability in virtual gateway com…7.6
• CVE-2026-10070A vulnerability was found in macrozheng mall up to 1.0.3. Th…5.1
• CVE-2026-100700nodemailer before 10.0.6 contains a denial of service vulner…7.5
• CVE-2026-100701Nodemailer versions 5.0.0 through 10.0.1 use a process-globa…5.9
• CVE-2026-100702Nodemailer before 10.0.2 fails to properly flatten deeply ne…5.9
• CVE-2026-100703Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Li…7.7
• CVE-2026-100705Kyverno before 1.19.1 is vulnerable to server-side request f…7.6
• CVE-2026-100706kyverno before 1.19.1 fails to properly validate URL-encoded…9.9
• CVE-2026-100707Kyverno before 1.19.1 contains a namespace isolation bypass …7.7
• CVE-2026-100708Froxlor before 2.3.13 returns the ssl_key_file column — whic…7.1
• CVE-2026-100709Froxlor through 2.3.10 stores only a numeric user ID in reme…7.5
• CVE-2026-10071DreamMaker developed by Interinfo has an Arbitrary File Uplo…9.8