Summary
Kyverno's ImageValidatingPolicy evaluator may treat a matching PolicyException as a full-resource exemption instead of limiting it to the specified images or allowed values. An attacker who can influence a matched workload or obtain approval for an overly broad exception may cause unsigned or untrusted images to enter the cluster without signature verification.
Affected context
The issue occurs in Kyverno deployments using the ImageValidatingPolicy resource and PolicyException objects from the policies.kyverno.io/v1beta1 API. When the exception's policy references and match conditions match a resource, the evaluator may skip image signature verification for every image on that resource because the exception's image and allowed-value restrictions are not applied.
Exploit preconditions
- Attack surface: Kubernetes admission control through Kyverno ImageValidatingPolicy evaluation
- Required access: The ability to create, modify, or cause evaluation of a matching PolicyException, or otherwise influence resources covered by one
- Trigger point: Admission of a resource whose policy references and match conditions satisfy a PolicyException
- Why exploitation is possible: The evaluator ignores
spec.imagesandspec.allowedValues, expanding a partial exception into a resource-wide verification exemption
Why this happens
The underlying bug is an authorization-scope failure in PolicyException evaluation. Although the exception contains fields intended to constrain which images or values are exempt, the ImageValidatingPolicy evaluator does not read those fields and instead skips verification for the entire matched resource. This maps to CWE-863: Incorrect Authorization, because a permission-like exception is applied beyond its intended scope.
Potential impact
- Unsigned or untrusted container images may be admitted to the cluster
- Image-signature enforcement may be bypassed for otherwise protected workloads
- Affected workloads could run tampered or malicious software
- Cluster integrity, workload confidentiality, or supply-chain trust could be weakened
General mitigation guidance
Mitigation generally focuses on preserving least-privilege exception semantics and reducing trust in broad admission bypasses.
Common defensive patterns include:
- Applying PolicyException scope consistently to the named images and allowed values
- Requiring explicit, narrowly scoped exception definitions
- Separating approval authority for policy exceptions from workload deployment authority
- Enforcing signature verification through an independent admission control layer where appropriate
- Reviewing existing exceptions for resource-wide behavior and removing unnecessary exemptions
- Running workloads with least privilege so an admitted image has limited blast radius
- Treating policy configuration and exception objects as protected security-sensitive resources
How teams detect issues like this
Organizations can identify this class of issue through:
- Tests that verify an exception for one image does not disable checks for other images on the same resource
- Admission-control integration tests covering
spec.images,spec.allowedValues, policy references, and match conditions - Static and semantic analysis of evaluators for ignored authorization-scope fields
- Code review checks requiring every exception constraint to affect the final authorization decision
- Kubernetes audit-log monitoring for PolicyException creation, modification, and use
- Policy enforcement that restricts who may create exceptions and requires narrowly scoped approvals
