{"id":"CVE-2026-122318","title":"Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates","summary":"Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate f…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","cvssSource":"cna","cwe":["CWE-295"],"vendor":"kyverno","product":"kyverno","affected":["kyverno < 1.19.2"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:25:17.874Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122318","references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv","label":"GitHub Security Advisory (GHSA-fcfr-fr8g-qjqv)"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates","label":"VulnCheck Advisory: Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.690Z","slug":"CVE-2026-122318","body":"## Overview\n\nKyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.\n\n## Affected\n\n- `kyverno < 1.19.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}