Authentication Bypass in Kyverno via Missing SAN in Certificate

Executive Summary

Kyverno before version 1.19.2 has an authentication bypass in the matchCertificateData function. When a signing certificate lacks a Subject Alternative Name (SAN), the system skips verifying images against subject and subjectRegExp checks. Attackers with a valid leaf certificate from a private trust root can exploit this by omitting the SAN, setting the Fulcio issuer OID, and signing malicious images that bypass signer pinning protections.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Kyverno versions before 1.19.2 using commands like 'kyverno version' or 'kubectl get deployment -n kyverno kyverno -o jsonpath='{.spec.template.spec.containers[0].image}''. Inspect logs for verifyImages rule failures or unexpected image admissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to sign and deploy malicious container images that bypass Kyverno's image verification rules. If your environment uses Kyverno for image signing and verification, unauthorized or malicious images could be admitted, potentially leading to supply chain attacks or unauthorized code execution.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Review verifyImages policies to ensure subject and subjectRegExp checks are enforced. Remove any certificates without SANs from trusted issuers in your PKI setup.

Useful 0 Not Useful 0