Dashboard / CVE-2026-122318

CVE-2026-122318

HIGH
MEDIUM Priority: 0.01 BB Relevance: 54/100
Published: 2026-11-05 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: X
AT: Present
VC: Low
VI: High
VA: Low

Description

Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
kyverno kyverno 0 < 1.19.2

References & Advisories (2)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

7.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.18%
Raw Score 0.001760
Percentile 7.2%
Date 2026-11-05

Intelligence Sources

mitre ref →
nvd ref →

External Links