Kyverno CVE-2026-100704

Exploitation requires Kyverno 1.14.0-1.19.0 actively enforcing image signature verification via the ImageValidatingPolicy resource (policies.kyverno.io/v1beta1), AND the existence of a PolicyException whose policyRefs and matchConditions match the target resource. The attacker needs authenticated Kubernetes API access sufficient to deploy or modify workloads matched by that exception (PR:L); the bug does not grant new access, it silently disables verification. Limiting factors: clusters that do not use ImageValidatingPolicy, do not define PolicyExceptions, or do not rely on signature verification are unaffected; ValidatingPolicy, GeneratingPolicy, and MutatingPolicy correctly treat these fields as partial exemptions and are not impacted. The flaw is a fail-open logic error triggered whenever a matching PolicyException is present, not a payload-crafting exploit.

This is a genuine policy-enforcement bypass in a Kubernetes admission-control engine, but it is a targeted integrity issue rather than a mass-exploited threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N, 8.3) is internally consistent with the description: network-reachable Kubernetes API, low complexity, low privileges (an authenticated principal able to create/apply PolicyException and workload resources), no user interaction, and integrity-only impact (untrusted images admitted) with no confidentiality or availability loss. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation likelihood cannot be quantified from these sources; absence of those signals is expected for a freshly disclosed logic flaw and does not indicate low risk on its own. The realistic risk is 'defense-in-depth control silently failing': the flaw only matters where an operator relies on Kyverno ImageValidatingPolicy signature verification AND a PolicyException exists (or an attacker with rights to create one exists). It is not a remote-unauthenticated code-execution bug, so it is a real supply-chain integrity priority for signature-enforcing clusters but not an internet-wide emergency. Note the CVSS is 4.0-only; no 3.1 vector was supplied for cross-checking.

In a cluster where Kyverno (1.14.0-1.19.0) enforces image signature verification via ImageValidatingPolicy, a team creates a PolicyException intended to exempt one trusted image using spec.images/spec.allowedValues. Because the evaluator ignores those fields, the exception disables signature verification for the entire matched resource, so an attacker (or a careless workload owner) can then deploy a pod containing unsigned or malicious images that are admitted without verification. No public exploit code is identified at time of analysis.