{"id":"CVE-2026-63121","aliases":[],"cve":{"records":[{"id":"CVE-2026-63121","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-15T16:54:55.816Z","published":"2026-10-30T22:08:03.004Z","modified":"2026-11-05T02:56:16.633Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:08:03.004Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T02:56:16.633Z"}],"references":[{"url":"https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/kubewarden/policies/commit/bc5597fcbbb0bc464b714ca7ff645c9743dea41b","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/kubewarden/policies/tree/trusted-repos-policy/v2.1.2","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-178","description":"CWE-178: Improper Handling of Case Sensitivity","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T02:56:06.807176Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.","score":6.3,"severity":"medium","published":"2026-10-30T22:08:03.004Z","modified":"2026-11-05T02:56:16.633Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"kubewarden","name":"policies","platforms":[],"versions":[{"version":"< 2.1.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-63121"}],"remediation":[],"references":["https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p","https://github.com/kubewarden/policies/commit/bc5597fcbbb0bc464b714ca7ff645c9743dea41b","https://github.com/kubewarden/policies/tree/trusted-repos-policy/v2.1.2"],"sources":[{"name":"CVE","id":"CVE-2026-63121","modified":"2026-11-05T02:56:16.633Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63121"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","score":6.3}],"sourceAffected":[],"observedAt":"2026-11-05T05:35:13.188Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:20:35.359Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T23:20:32.709Z","attemptedAt":"2026-10-30T23:20:32.709Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T23:20:32.652Z","attemptedAt":"2026-10-30T23:20:32.652Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T23:20:33.489Z","attemptedAt":"2026-10-30T23:20:33.489Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T23:20:32.043Z","attemptedAt":"2026-10-30T23:20:32.043Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-63121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63121","modified":"2026-10-30T22:16:58.123","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","checkedAt":"2026-10-30T23:20:32.709Z"}],"aiSummary":{"text":"Kubewarden policies versions before 2.1.2 have a case sensitivity weakness, allowing images with uppercase registry hostnames to bypass deny rules. The impact depends on the configured rejection policy and deployment environment. An attacker with access to the cluster can exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:21:12.934Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-63121"}]}}