CVE-2026-100704
Description
A flaw was found in Kyverno. When evaluating image validation policies, the policy exception handler fails to restrict exemptions to specific designated images, applying the exception to all images within a matching resource instead. An authenticated user can exploit this vulnerability to bypass image signature verification controls, allowing untrusted or unsigned container images to be admitted into the Kubernetes cluster.
Statement
An Important severity flaw was found in Kyverno, the Kubernetes policy engine shipped in the Konflux kyverno container images (konflux-1, konflux-pipeline-1). When Kyverno evaluates an ImageValidatingPolicy (policies.kyverno.io/v1beta1), the evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. As a result, any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource instead of only for the specifically exempted images, so an exception intended to exempt a single trusted image exempts every image on the matched resource(s). An authenticated user who can create or modify workload resources, or who is permitted to author a PolicyException, can exploit this behavior to admit unsigned or untrusted container images into a Kubernetes cluster without signature verification, defeating the supply-chain control that ImageValidatingPolicy with Notary/Cosign attestors is meant to enforce. Red Hat rates this flaw Important (CVSS 7.7, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N); the upstream CVSS:4.0 score of 8.3 reflects the newer scoring version rather than a materially different assessment of the flaw. All currently affected Red Hat products are the Konflux kyverno images, and a fix for them is being pursued through the delegated resolution.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Kyverno project has released a fix in version 1.19.1.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
