Authentication Bypass in Kyverno Affects Image Verification

CVE-2026-122318

What is CVE-2026-122318?

Kyverno prior to version 1.19.2 has a significant flaw where an authentication bypass occurs in the matchCertificateData function. This issue allows malicious actors, holding a valid leaf certificate from a configured private trust root, to exploit the vulnerability by omitting the Subject Alternative Name (SAN). Consequently, they can manipulate the expected Fulcio issuer OID to sign malicious images. These images can then bypass standard security checks, including signer pinning, leading to possible unauthorized access and security breaches.

References