CVE-2025-29778

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0 contains a patch for the issue.

How to fix CVE-2025-29778

To remediate CVE-2025-29778, upgrade the affected package to a fixed version below.

• —upgrade to 1.14.0 or later
• —upgrade to 1.14.0-alpha.1 or later
• —upgrade to 1.14.0-alpha.1 or later

Is CVE-2025-29778 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 1.14.0
• >= 1.13.0, < 1.14.0-alpha.1
• from 0, < 1.14.0-alpha.1

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-29778
• PATCHgithub.com/kyverno/kyverno
• WEBgithub.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60
• WEBgithub.com/kyverno/kyverno/pull/12237
• WEB