Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63121— Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

Quick assessment

Affected
kubewarden policies
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kubewarden 策略是一组用于保障和治理 Kubernetes 集群的 WebAssembly 策略。在暂定为受影响的 2.1.2 之前版本中， 策略在将镜像的 主机名与“拒绝列表”和“允许列表”进行比对时，采用了区分大小写的比较方式；然而， 的 DNS 名称本身是不区分大小写的。因此，若镜像的 主机名包含大写字母或采用混合大小写，则可能无法命中针对等效小写主机名的拒绝规则，导致准入策略错误地允许了本应被禁止的镜像（其容器运行时实际拉取的是同一被禁镜像）。该绕过漏洞仅存在于拒绝列表配置中：允许列表配置因对大小

CVSS 6.3 · Medium EPSS 0.19% · P9

Affected Version Matrix 1

VendorProduct Version RangeStatus
kubewarden policies < 2.1.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63121

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules
Source: CVE Program / CVE List V5
Vulnerability Description
Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kubewarden policies < 2.1.2 -

II. Public POCs for CVE-2026-63121

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63121

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-63121 (1)

IV. Related Vulnerabilities

Same product: policies
Same vendor: kubewarden
Same weakness: CWE-178