Read the docs
TI-2026-83428 Aliases CVE-2026-63121

Case-sensitive registry check in Kubewarden trusted-repos-policy

Priority LOW 27CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Kubewarden policies provisionally classified as affected before 2.1.2 include the trusted-repos-policy admission policy. The policy compares an image's registry hostname case-sensitively, although DNS names are case-insensitive (CWE-178). An image with an uppercase or mixed-case registry hostname can slip past a reject-list rule for the lowercase host, so admission accepts a prohibited image. Exploitation needs no privileges but requires user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed policies (kubewarden): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kubewardenpoliciesbefore 2.1.22.1.2Patch availableCNA
  • policies Vendorkubewarden Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA

Remediation

Upgrade Kubewarden policies to version 2.1.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA policies (kubewarden) Fixed in 2.1.2

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-63121
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-05 CISA SSVC decision points changed

References

Other 3

  • TI-2025-18119 The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources CVSS 3.1MEDIUM 6.5
  • TI-2025-18501 kubewarden-controller has an Information leak via AdmissionPolicyGroup Resource CVSS 3.1MEDIUM 4.3
  • TI-2026-30821 Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences