Summary
Kyverno can skip verifyImages subject and subject regular-expression checks when a signing certificate has no Subject Alternative Name (SAN). An attacker with a leaf certificate chaining to a configured private trust root may be able to sign an image that passes signer pinning and is admitted despite not meeting the intended identity constraints.
Kyverno can skip verifyImages subject and subject regular-expression checks when a signing certificate has no Subject Alternative Name (SAN). An attacker with a leaf certificate chaining to a configured private trust root may be able to sign an image that passes signer pinning and is admitted despite not meeting the intended identity constraints.
Affected context
The issue occurs in Kyverno image verification when certificate data is matched and the signing certificate lacks a SAN. In affected configurations, the subject and subject-regexp checks may be skipped under that condition. Risk depends on the configured trust roots, verification policy, and whether an attacker can obtain or use a leaf certificate trusted by those roots.
The issue occurs in Kyverno image verification when certificate data is matched and the signing certificate lacks a SAN. In affected configurations, the subject and subject-regexp checks may be skipped under that condition. Risk depends on the configured trust roots, verification policy, and whether an attacker can obtain or use a leaf certificate trusted by those roots.
Exploit preconditions
- Attack surface: Image admission through Kyverno
verifyImagespolicies - Required access: A leaf certificate issued under a configured private trust root, plus the ability to sign an image with its corresponding key
- Trigger point: Kyverno evaluates the signing certificate during image verification
- Why exploitation is possible: A certificate without a SAN can cause subject identity checks to be skipped; setting the expected Fulcio issuer OID may allow the image to pass despite signer pinning
- Attack surface: Image admission through Kyverno
verifyImagespolicies - Required access: A leaf certificate issued under a configured private trust root, plus the ability to sign an image with its corresponding key
- Trigger point: Kyverno evaluates the signing certificate during image verification
- Why exploitation is possible: A certificate without a SAN can cause subject identity checks to be skipped; setting the expected Fulcio issuer OID may allow the image to pass despite signer pinning
Why this happens
Certificate matching handles certificates without a SAN in a way that bypasses configured subject and subject-regexp checks. This is an improper certificate validation pattern: identity constraints are not consistently enforced for every certificate shape. It maps to CWE-295: Improper Certificate Validation, because certificate data is accepted without applying the intended identity verification.
Certificate matching handles certificates without a SAN in a way that bypasses configured subject and subject-regexp checks. This is an improper certificate validation pattern: identity constraints are not consistently enforced for every certificate shape. It maps to CWE-295: Improper Certificate Validation, because certificate data is accepted without applying the intended identity verification.
Potential impact
- An image signed by an unintended trusted certificate may be admitted
- Image signer pinning and related admission controls could be weakened
- Malicious workloads could be deployed and run in affected environments
- The integrity of software supply-chain controls may be reduced
- An image signed by an unintended trusted certificate may be admitted
- Image signer pinning and related admission controls could be weakened
- Malicious workloads could be deployed and run in affected environments
- The integrity of software supply-chain controls may be reduced
General mitigation guidance
Defensive patterns focus on consistently validating certificate identity and failing closed when required identity data is absent.
- Require the expected SAN and subject constraints to be present and match before accepting a certificate
- Apply identity checks consistently across certificates with and without SAN values
- Use narrowly scoped trust roots and minimize who can obtain or use trusted signing certificates
- Combine certificate identity checks with other controls, such as trusted registries and image digest verification
- Apply least privilege to workloads admitted by image policies
Defensive patterns focus on consistently validating certificate identity and failing closed when required identity data is absent.
- Require the expected SAN and subject constraints to be present and match before accepting a certificate
- Apply identity checks consistently across certificates with and without SAN values
- Use narrowly scoped trust roots and minimize who can obtain or use trusted signing certificates
- Combine certificate identity checks with other controls, such as trusted registries and image digest verification
- Apply least privilege to workloads admitted by image policies
How teams detect issues like this
- Review certificate-matching logic for conditional branches that skip identity checks when SAN data is absent
- Use static analysis and code review to trace certificate parsing through all verification outcomes
- Test policies with certificates that omit SAN values and verify that missing identity data causes rejection
- Enforce policy checks requiring explicit certificate identity constraints and narrowly scoped trust roots
- Monitor admission decisions for images whose certificates lack expected identity fields
- Review certificate-matching logic for conditional branches that skip identity checks when SAN data is absent
- Use static analysis and code review to trace certificate parsing through all verification outcomes
- Test policies with certificates that omit SAN values and verify that missing identity data causes rejection
- Enforce policy checks requiring explicit certificate identity constraints and narrowly scoped trust roots
- Monitor admission decisions for images whose certificates lack expected identity fields
