CVE-2026-122318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122318", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T23:25:07.316Z", "datePublished": "2026-11-05T02:25:17.874Z", "dateUpdated": "2026-11-09T16:53:01.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T02:25:17.874Z"}, "datePublic": "2026-10-21T00:00:00.000Z", "title": "Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates", "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "affected": [{"vendor": "kyverno", "product": "kyverno", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/kyverno/kyverno", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.19.2"}, {"version": "1.19.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.19.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-fcfr-fr8g-qjqv)"}, {"name": "VulnCheck Advisory: Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates"}], "credits": [{"lang": "en", "value": "arpitjain099", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:10:00.470530Z", "id": "CVE-2026-122318", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:53:01.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122318", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:10:00.470530Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:10:02.418Z"}}], "cna": {"title": "Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates", "credits": [{"lang": "en", "type": "finder", "value": "arpitjain099"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"status": "affected", "version": "0", "lessThan": "1.19.2", "versionType": "semver"}, {"status": "unaffected", "version": "1.19.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/kyverno/kyverno", "defaultStatus": "unaffected"}], "datePublic": "2026-10-21T00:00:00.000Z", "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv", "name": "GitHub Security Advisory (GHSA-fcfr-fr8g-qjqv)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates", "name": "VulnCheck Advisory: Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.19.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T02:25:17.874Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122318", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:53:01.028Z", "dateReserved": "2026-11-04T23:25:07.316Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T02:25:17.874Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/kyverno/kyverno", "product": "kyverno", "vendor": "kyverno", "versions": [{"lessThan": "1.19.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.19.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B2692EA-D839-4E73-A94D-EDB877C4C6A0", "versionEndExcluding": "1.19.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning."}], "id": "CVE-2026-122318", "lastModified": "2026-11-10T20:32:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.3, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122318", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:10:00.470530Z", "version": "2.0.3"}}]}, "published": "2026-11-05T03:17:24.523", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/kyverno/kyverno: Kyverno: Image verification bypass via missing Subject Alternative Name in signing certificates", "id": "2567773", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567773"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L", "status": "draft"}, "cwe": "CWE-295", "details": ["Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.", "A flaw was found in Kyverno. This vulnerability allows an attacker possessing a certificate issued by a trusted private authority to bypass image verification policies. By omitting the Subject Alternative Name (SAN) from a signing certificate, identity checks on image signers are skipped during policy evaluation. Consequently, an attacker can deploy unauthorized or malicious container images into the cluster despite configured signer restrictions."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122318", "public_date": "2026-11-05T02:25:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122318\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122318\nhttps://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv\nhttps://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates"], "statement": "This vulnerability is rated Important because a successful bypass directly undermines Kubernetes admission security controls by permitting unauthorized container workloads to execute in the cluster. While exploitation requires low-privileged access to obtain a certificate issued under a configured trust chain, the resulting breakdown of supply chain integrity allows arbitrary image admission across impacted namespaces. Clusters that do not utilize Kyverno for image signature validation or that do not enforce subject-based constraints are not impacted.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.19.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kyverno", "source": "cna", "vendor": "kyverno"}, "product": "kyverno", "vendor": "kyverno"}], "created": "2026-11-05T03:45:17.995029+00:00", "updated": "2026-11-05T04:30:11.111226+00:00", "vendors": ["kyverno", "kyverno$PRODUCT$kyverno"]}