Summary
If a Kyverno verifyImages rule pins an image signer by subject or subjectRegExp and the signing certificate carries no Subject Alternative Name, the subject check is skipped entirely and the image is admitted. The issuer check still runs, so this is not a total no-op, but the identity half of the pin silently passes for any cert with an empty SAN. This is a residual of CVE-2025-29778 / GHSA-46mp-8w32-6g94 — that fix added subjectRegExp/issuerRegExp handling but placed the whole subject-matching block inside a len(sans) > 0 guard, so a cert with zero SANs bypasses it.
Impact
In matchCertificateData in pkg/image/verifiers/cpol/cosign/cosign.go, the subject-matching block is guarded by len(sans) > 0, where sans is derived from the certificate's Subject Alternative Name extension. When the cert has no SAN, the inner block that enforces the subject or subjectRegExp pin is skipped and execution falls through with no error. The issuer check remains enforced through matchExtensions against a Fulcio OID extension. An attacker who can obtain a leaf certificate from the configured private trust root — without a SAN but with the expected issuer OID value — can sign an unauthorized image that Kyverno will admit despite the subject pin. This vulnerability only affects configurations using a custom or private trust root (keyless.roots); the public Fulcio keyless path is not affected because public Fulcio always issues certs with SANs.
Detection
No warning or error is logged when the subject check is bypassed. The admission succeeds silently. Audit image admission events against expected signer identities from your CI pipeline. If using a private CA, review issued certificates to verify all include a Subject Alternative Name extension. Consult the advisory at the reference URL for proof-of-concept code demonstrating the bypass.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which fixes matchCertificateData to enforce the subject and subjectRegExp check regardless of whether the certificate carries a SAN. Until upgraded, avoid configuring keyless.roots with a private CA that may issue certificates without a SAN extension, or add a certificate validation step in the CI pipeline to enforce SAN presence before publishing images.
Related Security Guidance
References
- GHSA-fcfr-fr8g-qjqv — Kyverno Security Advisory