CVE-2026-122318

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.2

Description An authentication bypass exists in the matchCertificateData function. This issue occurs when a signing certificate lacks a Subject Alternative Name (SAN), causing the system to skip verifyImages subject and subjectRegExp checks. An attacker possessing a leaf certificate from a configured private trust root can omit the SAN and set the expected Fulcio issuer OID to sign malicious images, which are then admitted despite signer pinning.

Recommendations Update to version 1.19.2 or later.