Kyverno, a Kubernetes policy engine, contained a flaw in versions 1.14.0 through 1.19.0 where the ImageValidatingPolicy evaluator ignored the spec.images and spec.allowedValues fields of a PolicyException. The exception logic would skip signature verification for the entire resource instead of only the specified images, allowing unsigned or untrusted images to be accepted as legitimate. This circumvents one of the core integrity checks that Kyverno provides, potentially leading to the execution of malicious containers. The weakness is identified as CWE‑863.

The vulnerability affects Kyverno deployments running any version from 1.14.0 up to and including 1.19.0. The specific component involved is the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator within those releases.

The vulnerability carries a CVSS score of 8.3, indicating a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the current threat landscape exposure is unclear. An attacker would need the capability to create or modify PolicyException resources that match the target Kubernetes resources. Once such an exception is in place, any image deployed to the matched resource bypasses signature verification. The attack vector is inferred to be an authenticated privilege that allows modification of PolicyExceptions within the cluster.