CVE-2026-122318: Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates
Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kyvernoto a version that resolves this vulnerability.Fixed in 1.19.2
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Kyverno deployments before 1.19.2 that use verifyImages identity constraints such as subject or subjectRegExp and trust a private certificate root are exposed. The bypass concerns image signatures validated through certificates issued by that configured private trust root.
What must an attacker have to exploit it?
The attacker needs a leaf certificate from a configured private trust root. They must be able to use a certificate without a Subject Alternative Name, set the expected Fulcio issuer OID, and sign an image.
How can I determine whether a policy is affected?
Review verifyImages policies for subject or subjectRegExp signer identity checks and determine whether the associated trust configuration includes a private trust root. Then check whether the Kyverno version is earlier than 1.19.2.
What is the remediation?
Upgrade Kyverno to version 1.19.2 or later. The provided information does not identify a workaround for installations that cannot be upgraded immediately.