CVE-2026-63121

MediumCVSS 6.3

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

In Kubewarden policies before version 2.1.2, the trusted-repos-policy compares an image's registry hostname against reject and allow lists case-sensitively even though registry DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image.

Risk Assessment

Bypassing the reject list may allow deployment of prohibited container images, violating cluster security policy and potentially introducing untrusted code into the environment.

Recommendation

Update Kubewarden policies to version 2.1.2 or later, which fixes the case-insensitive registry hostname comparison issue.

Other vulnerabilities in Kubewarden

CVE-2026-42541Medium
Kubewarden, a policy engine for Kubernetes, has a policy-level authorization gap. An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions can use the can_i host callback to issue SubjectAccessReview requests and enumerate RBAC permissions of any user or service account across the cluster, even without a context-aware resource grant.

Original NVD description (English source)

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS