CVE-2025-29778: Kyverno Auth Bypass Vulnerability

CVE-2025-29778 Overview

CVE-2025-29778 is an improper authorization vulnerability [CWE-285] in Kyverno, a policy engine used by Kubernetes platform engineering teams. Versions prior to 1.14.0-alpha.1 ignore the subjectRegExp and issuerRegExp fields when verifying artifact signatures in keyless mode. Attackers can deploy Kubernetes resources signed by an unexpected certificate, bypassing supply chain controls intended to enforce trusted signers. Successful exploitation can lead to full compromise of the Kubernetes cluster. The Kyverno maintainers shipped a fix in version 1.14.0-alpha.1.

Critical Impact
Attackers can deploy workloads signed by untrusted certificates into a Kubernetes cluster, defeating Kyverno's keyless image verification and enabling cluster compromise.

Affected Products

Kyverno versions prior to 1.14.0-alpha.1
Kubernetes clusters relying on Kyverno keyless verification policies
CI/CD pipelines enforcing Cosign keyless signature checks via Kyverno

Discovery Timeline

2025-03-24 - CVE-2025-29778 published to NVD
2025-08-01 - Last updated in NVD database

Technical Details for CVE-2025-29778

Vulnerability Analysis

Kyverno integrates with Sigstore Cosign to verify container image signatures in keyless mode. Policy authors specify trusted signer identities using either exact-match fields (subject, issuer) or regular expression fields (subjectRegExp, issuerRegExp). The vulnerable matchSignatures function in pkg/cosign/cosign.go only inspects the exact-match fields when deciding whether to evaluate signer identity. If a policy relies solely on regular expression matching, the function short-circuits and returns success without comparing the signer at all.

The outcome is a policy that appears to enforce keyless verification yet accepts any valid Sigstore signature, regardless of issuer or subject. An attacker controlling any workload identity capable of producing a Cosign keyless signature can push and deploy images that policy was meant to block.

Root Cause

The root cause is a missing conditional check on the regular expression fields. The original guard returned nil (allow) whenever subject, issuer, and extensions were empty, ignoring that the policy author may have populated subjectRegExp or issuerRegExp instead. This is a classic improper authorization flaw [CWE-285] where validation logic fails to consider all configured constraints.

Attack Vector

An attacker with the ability to publish a Cosign-signed artifact, using any OIDC identity accepted by Sigstore's public Fulcio, can craft an image that satisfies the broken check. The attacker then deploys a Kubernetes manifest referencing this image. Kyverno's admission webhook approves the resource, allowing the attacker to introduce malicious workloads, sidecars, or controllers that may pivot to cluster-wide compromise.

// Patch in pkg/cosign/cosign.go (#12237)
func matchSignatures(signatures []oci.Signature, subject, subjectRegExp, issuer, issuerRegExp string, extensions map[string]string) error {
-	if subject == "" && issuer == "" && len(extensions) == 0 {
+	if subject == "" && issuer == "" && subjectRegExp == "" && issuerRegExp == "" && len(extensions) == 0 {
 		return nil
 	}

Source: Kyverno commit 8777672

Detection Methods for CVE-2025-29778

Indicators of Compromise

Kubernetes audit log entries showing workloads admitted by Kyverno despite using image signers not matching the policy's subjectRegExp or issuerRegExp values.
Cosign signature records in the Rekor transparency log referencing OIDC identities that do not belong to the organization's authorized signers.
Container images deployed from registries or tags not previously approved in the supply chain inventory.

Detection Strategies

Audit existing ClusterPolicy and Policy resources for verifyImages rules that rely exclusively on subjectRegExp or issuerRegExp and validate them against the running Kyverno version.
Replay recent admission decisions against a patched Kyverno instance in staging to identify images that were incorrectly admitted.
Correlate Kubernetes admission events with Rekor entries to confirm that admitted images were signed by an expected issuer.

Monitoring Recommendations

Enable Kubernetes audit logging at the RequestResponse level for pods, deployments, and other workload resources to capture image references at admission time.
Stream Kyverno policy reports and admission webhook logs into a SIEM or data lake for retroactive hunting. SentinelOne Singularity Data Lake can ingest Kubernetes and Kyverno telemetry via OCSF normalization for centralized analysis.
Use SentinelOne Singularity Cloud Native Security to inventory workloads, scan container images and infrastructure-as-code, and surface misconfigurations in admission policies before they reach production.

How to Mitigate CVE-2025-29778

Immediate Actions Required

Upgrade Kyverno to version 1.14.0-alpha.1 or later, where commit 8777672 adds the missing regular expression checks to matchSignatures.
Inventory all verifyImages rules and confirm they enforce both issuer/issuerRegExp and subject/subjectRegExp constraints against trusted signers.
Review recent admissions of images verified by keyless mode and validate their signer identities against the Rekor transparency log.

Patch Information

The fix is delivered in Kyverno 1.14.0-alpha.1 via pull request #12237 and commit 8777672fb17bdf252bd2e7d8de3441e240404a60. Full advisory details are available in the Kyverno GHSA-46mp-8w32-6g94 advisory.

Workarounds

Replace regex-only signer constraints with exact-match subject and issuer values until the patched version is deployed.
Add a defense-in-depth admission controller, such as Sigstore Policy Controller, that independently verifies image signatures.
Restrict which registries the cluster may pull from using image policy webhooks or network egress controls, limiting attacker-controlled image sources.

bash

# Example: pin Kyverno to the patched version using Helm
helm repo update
helm upgrade kyverno kyverno/kyverno \
  --namespace kyverno \
  --version >=1.14.0-alpha.1

# Verify the deployed version
kubectl -n kyverno get deploy -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'