CVE-2025-29778 Kyverno ignores subjectRegExp and IssuerRegExp
Kyverno fails to validate certificate subject and issuer regexes in keyless mode, allowing attackers to deploy unauthorized resources and compromise the cluster.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29778?
CVE-2025-29778 is a medium-severity authentication bypass vulnerability in kyverno, published on 24 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.
Weakness: CWE-285
Which versions are affected by CVE-2025-29778?
4 open source packages ship an affected version, including github.com/kyverno/kyverno and kyverno. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kyverno/kyverno Go | All versions | 1.14.0-alpha.1 |
github.com/kyverno/kyverno Go | From 1.13.0 | 1.14.0-alpha.1 |
github.com/kyverno/kyverno Go | From 1.13.0 | 1.14.0-alpha.1 |
kyverno Bitnami | All versions | 1.14.0 |
Products include Kyverno Kyverno.
How do I fix CVE-2025-29778?
Upgrade github.com/kyverno/kyverno to 1.14.0-alpha.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-29778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29778 exists.
Other vulnerabilities in kyverno
- CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
- CVE-2026-4789 CVE-2026-4789
- CVE-2025-46342 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
- CVE-2026-41323 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
- CVE-2026-40868 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Sources
Also known as BIT-kyverno-2025-29778, GHSA-46mp-8w32-6g94, GO-2025-3562, MINI-3gmf-mx96-c8fv, MINI-3m24-pc86-v9x5, MINI-95qh-8v3j-mc4m and 2 more.