PatchTheCVECVE-2026-122318: Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subjec
CVE-2026-122318 is a high-severity flaw (CVSS 7.7) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.7 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2026-11-05 |
| Last modified | 2026-11-05 |
Last updated 2026-11-05 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- VulDB Recent Entries: CVE-2026-122318 | Kyverno up to 1.19.1 Certificate Verification matchCertificateData improper authentication 2026-11-05
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-122318?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-122318 being exploited?
CVE-2026-122318 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-122318 affect?
CVE-2026-122318 affects affected software. Severity is high (CVSS 7.7). Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from
How urgent is CVE-2026-122318?
Priority 27/100. High severity