The vulnerability resides in the way the trusted‑repos‑policy compares an image’s registry hostname against reject and allow lists. The comparison is case‑sensitive, while DNS names are case‑insensitive, which means an image whose registry hostname contains one or more uppercase letters can slip past a deny rule that targets the same host in all lowercase. This flaw can allow forbidden container images to be admitted to a Kubernetes cluster, potentially introducing malicious code or violating compliance requirements. The weakness is a case‑handling error (CWE‑178).

The issue affects Kubewarden’s trusted‑repos‑policy in all releases older than version 2.1.2. Administrators using the legacy policy in Kubernetes clusters are directly impacted if their policies rely on reject rules that target registry hostnames.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, so the current probability of exploitation is uncertain, yet the vulnerability is exercised in a way that can be exploited during admission of container workloads. It is not listed in CISA KEV, but the potential for unauthorized image deployment makes it a concern for environments that enforce strict image provenance. The likely attack vector is admission of a deployment or pod specification that contains an image tag with an uppercase or mixed‑case registry hostname. An attacker with the ability to create or modify such manifests can bypass reject rules and introduce a prohibited image. The risk is higher in clusters that use reject‑list configurations, while allow‑list configurations remain closed off to differently cased hostnames.