Kyverno before version 1.19.2 contains a logic flaw in the matchCertificateData function that bypasses the verification of the certificate’s subject and subjectRegExp fields when the signing certificate lacks a Subject Alternative Name. An adversary who possesses a leaf certificate issued by a trusted private root can create such a certificate with an empty SAN, set the expected Fulcio issuer OID, and sign a malicious container image. When Kyverno evaluates the image, the bypass causes the image to be accepted as if it were signed by a trusted entity, allowing the attacker to deploy compromised containers under the guise of legitimate imagery. The vulnerability is a classic authentication bypass reflected by CWE‑295.

All Kyverno deployments using a version earlier than 1.19.2 are affected. No other vendors or product lines are listed in the CNA data.

The weakness carries a CVSS v3.1 score of 7.2, indicating high severity. The EPSS score is not available, and the vulnerability is not included in CISA’s KEV catalog, so there is no evidence of current active exploitation. Successful exploitation requires the attacker to hold a leaf certificate from a configured private trust root and the ability to sign container images. The threat is therefore most relevant to internal actors or compromised certificate holders. If exploited, the attacker can foil Kyverno’s image pinning and deploy malicious workloads with the elevated privileges of legitimate images.