ImageValidatingPolicy Exception Bypass in Kyverno Kubernetes Policy Engine
CVE-2026-100704

8.3HIGH

Key Information:

Vendor

Kyverno

Status
Kyverno
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100704?

In versions 1.14.0 through 1.19.0 of Kyverno, a policy engine designed for Kubernetes, an evaluation flaw exists in the ImageValidatingPolicy. Specifically, the evaluator fails to properly assess the spec.images and spec.allowedValues fields within a PolicyException. Consequently, if a PolicyException’s policyRefs and matchConditions align with a resource, it allows for the bypass of image signature verification for the entire resource instead of limiting the exemption to only the specified images or values. This means that untrusted or unsigned images can be admitted to the Kubernetes cluster without proper verification, increasing the risk of security vulnerabilities. This issue has been rectified in version 1.19.1.

Affected Version(s)

kyverno 1.14.0 < 1.19.1

kyverno 1.19.1

References

https://github.com/kyverno/kyverno/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/kyverno-before-1.19....
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zanarellidev
.