CVE-2026-100704: 
Kyverno Analyse et atténuation des vulnérabilités

CVE-2026-100704 is a security feature bypass vulnerability in Kyverno, a policy engine for Kubernetes, affecting versions 1.14.0 through 1.19.0. The flaw resides in the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator, which fails to read the spec.images and spec.allowedValues fields of a PolicyException, causing any matching exception to fully bypass image signature verification for an entire resource rather than only the specified images. The vulnerability was privately reported on 2026-07-30 and publicly disclosed on September 26, 2026, with a fix released in version 1.19.1. It carries a CVSS v3.1 score of 7.7 (High) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization). In pkg/image/verification/evaluator/compiler.go, the compilerImpl.Compile function builds compiledExceptions from PolicyException objects but only compiles polex.Spec.MatchConditions — it never reads polex.Spec.Images or polex.Spec.AllowedValues. At evaluation time in pkg/image/verification/evaluator/policy.go, if any compiled exception's MatchConditions evaluate to true, the function immediately returns with a full exemption result, skipping all signature-verification CEL expressions for the entire resource without any per-image filtering. This behavior is inconsistent with ValidatingPolicy, GeneratingPolicy, and MutatingPolicy, which correctly treat spec.images/spec.allowedValues as partial exemptions. An authenticated attacker with permissions to create or modify PolicyException objects can exploit this by crafting an exception that matches a target resource, causing all image verification to be skipped cluster-wide for matched resources (GitHub Advisory).

Successful exploitation allows unsigned or untrusted container images to be admitted into a Kubernetes cluster without signature verification, directly undermining supply-chain security controls enforced by Notary or Cosign attestors. An attacker with permission to author a PolicyException — or who can compromise an account with such permissions — can effectively disable image verification cluster-wide for all resources matched by the exception's policyRefs and matchConditions. This creates a pathway for deploying malicious or tampered container images, potentially enabling code execution, lateral movement within the cluster, and persistent access (GitHub Advisory, Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability requires low privileges — specifically, the ability to create or modify PolicyException resources in the cluster — and no user interaction. The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, GitHub Advisory).

1. Reconnaissance: Identify a target Kubernetes cluster running Kyverno versions 1.14.0–1.19.0 with ImageValidatingPolicy enforcing image signature verification (e.g., requiring Notary or Cosign signatures) and policyExceptions enabled (features.policyExceptions.enabled=true).
2. Obtain permissions: Acquire credentials or a service account with RBAC permissions to create or modify PolicyException resources in the configured exception namespace (e.g., the namespace specified by --exceptionNamespace).
3. Craft a PolicyException: Create a PolicyException manifest that references the target ImageValidatingPolicy in spec.policyRefs and sets spec.images to a single trusted image (e.g., ghcr.io/org/trusted-image:signed). Due to the bug, the spec.images field is ignored entirely.
4. Apply the exception: Submit the crafted PolicyException to the cluster using kubectl apply -f malicious-exception.yaml. The exception's matchConditions (or lack thereof) will match the target resource(s).
5. Deploy unsigned/untrusted image: Submit a Pod or workload manifest referencing an unsigned or untrusted image (e.g., ghcr.io/org/malicious-image:unsigned). The Kyverno admission webhook evaluates the ImageValidatingPolicy, finds the matching exception, and skips all image signature verification for the entire resource.
6. Achieve objective: The unsigned image is admitted to the cluster, enabling execution of arbitrary or tampered container workloads (GitHub Advisory).

• Kubernetes Audit Logs: Creation or modification of PolicyException resources (kind: PolicyException, apiVersion: policies.kyverno.io/v1beta1) by non-administrative accounts or in unexpected namespaces; review kubectl get policyexceptions -A for anomalous entries.
• Kyverno Admission Logs: Admission webhook logs showing resources admitted with exception matches (result.Exceptions non-empty) for workloads containing images not listed in the exception's spec.images field.
• Container Runtime: Presence of unsigned or unverified container images running in the cluster; cross-reference running image digests against known-good signed image registries.
• RBAC Changes: Unexpected grants of create/update/patch permissions on policyexceptions resources to non-admin subjects in cluster RBAC audit logs (GitHub Advisory).

Upgrade Kyverno to version 1.19.1 or later, which fixes the issue by mirroring the Images/AllowedValues enforcement already implemented for ValidatingPolicy, GeneratingPolicy, and MutatingPolicy. Until patching is possible, restrict RBAC permissions for creating and modifying PolicyException resources to trusted cluster administrators only, and audit all existing PolicyException objects to ensure none unintentionally bypass image verification. As a defense-in-depth measure, consider implementing additional image verification controls outside of Kyverno (e.g., OCI registry admission controls or external admission webhooks) (GitHub Advisory, Github Advisory).

The vulnerability was originally reported privately to the Kyverno security team via kyverno-security@googlegroups.com on 2026-07-30 by researcher zanarellidev, who also filed the GitHub security advisory as a redundant record. The advisory includes detailed proof-of-concept evidence — both a unit test and a real-cluster reproduction against Kyverno v1.18.2 on k3s — demonstrating the full bypass. No significant broader media coverage or social media discussion has been observed at the time of disclosure (GitHub Advisory).