CVE-2026-63121

Name of the Vulnerable Software and Affected Versions Kubewarden policies versions prior to 2.1.2

Description The trusted-repos-policy performs case-sensitive comparisons of an image's registry hostname against reject and allow lists, despite DNS names being case-insensitive. This allows a bypass of reject-list configurations by using uppercase or mixed-case hostnames, leading the admission policy to accept resources that the container runtime then pulls from a prohibited image registry. Allow-list configurations are not bypassed but instead fail closed by denying hostnames with different casing.

Recommendations Update to version 2.1.2.