Kubewarden trusted-repos-policy Case-Sensitive Registry Bypass

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63121

Affected Vendors & Products

Vendor	Product	Version / Range
kubewarden	policies	< 2.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

Executive Summary

Kubewarden policies before version 2.1.2 has a case-sensitivity issue in the trusted-repos-policy. It compares image registry hostnames against reject and allow lists in a case-sensitive manner, even though DNS names are case-insensitive. This allows an image with an uppercase or mixed-case registry hostname to bypass a rejection rule for the equivalent lowercase hostname, potentially allowing prohibited images to be accepted by the admission policy.

Impact Analysis

If you use a reject-list configuration in Kubewarden policies before 2.1.2, an attacker could deploy a container with an image from a registry using a mixed-case hostname to bypass security restrictions. This could lead to unauthorized or prohibited images being pulled into your Kubernetes cluster, potentially compromising security or violating compliance policies.

Mitigation Strategies

Upgrade Kubewarden policies to version 2.1.2 or later to fix the case-sensitive registry hostname comparison issue.

Hi! I’m here to help you understand CVE-2026-63121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70