In Kyverno versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator does not read the spec.images and spec.allowedValues fields of a PolicyException. Consequently, any PolicyException matching a resource causes the image signature verification to be skipped for the entire resource rather than just the specified images or values. This behavior allows unsigned or untrusted container images to be admitted into the Kubernetes cluster without signature verification, which differs from other policy types that treat these fields as partial exemptions. The vulnerability is fixed in Kyverno version 1.19.1.

This vulnerability allows attackers or misconfigured policies to bypass image signature verification for all images in a resource when an exception is applied, potentially admitting unsigned or untrusted container images into the Kubernetes cluster. This can lead to the deployment of malicious or unverified container images, increasing the risk of compromise or unauthorized code execution within the cluster. The CVSS 3.1 score is 7.7 (High), reflecting the network attack vector, low attack complexity, required privileges, no user interaction, scope change, no confidentiality impact, high integrity impact, and no availability impact.

Upgrade Kyverno to version 1.19.1 or later, where this issue is fixed. Until the upgrade is applied, carefully review and limit the use of PolicyExceptions in ImageValidatingPolicy to minimize the risk of unintended image verification bypass. No other vendor advisories indicate alternative mitigations or that the issue is already mitigated.