CVE-2026-100704 in Kyverno
Summary
by MITRE • 09/26/2026
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource rather than only for the listed images or values, so an exception intended to exempt a single trusted image exempts every image on the matched resource(s). As a result, unsigned or untrusted images can be admitted to the cluster without signature verification. This differs from ValidatingPolicy, GeneratingPolicy, and MutatingPolicy, which treat the same field as a partial exemption. The issue is fixed in version 1.19.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
Kyverno serves as a comprehensive policy engine for Kubernetes environments, enabling organizations to enforce security standards through declarative policies that govern resource admission and configuration. Within this framework, ImageValidatingPolicy resources are specifically designed to verify the integrity of container images by checking digital signatures against trusted registries or keys. This mechanism is critical for maintaining supply chain security, ensuring that only verified artifacts run within the cluster infrastructure. However, in Kyverno versions ranging from 1.14.0 through 1.19.0, a significant logical flaw exists within the evaluator responsible for processing PolicyException resources associated with ImageValidatingPolicy rules. A PolicyException is intended to provide granular exemptions, allowing specific images or values to bypass certain checks while maintaining security controls for all other components of a workload.
The core technical vulnerability lies in how the engine parses and applies the spec.images and spec.allowedValues fields within these exceptions. Instead of treating these fields as filters that limit the scope of the exemption to only the specified image digests, tags, or values, the flawed implementation ignores them entirely during the evaluation process. Consequently, when a PolicyException matches a resource based on its policyRefs and matchConditions, the engine applies a blanket bypass for all image validation checks associated with that rule. This means that if an administrator creates an exception intended to exempt only one specific trusted image from signature verification due to registry unavailability or other operational constraints, the result is that every container image within the matched pod or deployment skips signature verification entirely.
This behavior represents a severe deviation from the expected security posture and differs markedly from how Kyverno handles similar exemptions in ValidatingPolicy, GeneratingPolicy, and MutatingPolicy contexts, where field-specific scoping functions correctly as partial exemptions. The operational impact is substantial, as it allows unsigned, untrusted, or potentially malicious container images to be admitted into the cluster without undergoing cryptographic verification. This undermines the integrity of the software supply chain, exposing the environment to risks associated with compromised artifacts, such as backdoors, malware injection, or unauthorized code execution. Attackers who can influence workload definitions could exploit this misconfiguration to deploy unverified containers that bypass critical security gates established by organizational policy.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-697 Incorrect Comparison, as the system fails to correctly interpret the scope of exemption parameters provided in the configuration. In terms of attack vectors, it relates to MITRE ATT&CK techniques involving container image manipulation or abuse of legitimate admission controls to bypass security monitoring. The flaw effectively creates a false sense of security where policies appear enforced but are silently disabled for entire workloads rather than specific components.
The issue has been addressed in Kyverno version 1.19.1, which corrects the logic to ensure that spec.images and spec.allowedValues properly restrict the exemption scope as originally intended by administrators. Organizations running affected versions should prioritize upgrading immediately to restore granular control over image validation exemptions. Until an upgrade is performed, security teams must audit existing PolicyException resources for ImageValidatingPolicy rules to identify any broad exceptions that may inadvertently disable signature verification across entire deployments and manually revoke or refine these exceptions to limit their scope strictly to the intended images.