{"affected":[{"product":"policies","source":"CNA: GitHub_M","vendor":"kubewarden","versions":[{"status":"affected","version":"< 2.1.2"}]},{"ecosystem":"kubewarden","packageName":"trusted-repos-policy","product":"trusted-repos-policy","source":"GitHub GHSA-8p62-9vh2-272p","vendor":"","versions":[{"status":"affected","version":"2.1.1","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-63121","cwes":["CWE-178"],"description":"Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.","epss":{"date":"2026-11-04","percentile":0.09086,"score":0.00193},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},{"score":6.3,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793847376633,"publishedAt":1793398083004,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/kubewarden/policies/commit/bc5597fcbbb0bc464b714ca7ff645c9743dea41b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/kubewarden/policies/tree/trusted-repos-policy/v2.1.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/kubewarden/policies/commit/bc5597fcbbb0bc464b714ca7ff645c9743dea41b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/kubewarden/policies/tree/trusted-repos-policy/v2.1.2"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-8p62-9vh2-272p","text":"trusted-repos-policy (kubewarden): GitHub reports patched versions 2.1.2. Check the advisory for the affected release branch.","url":"https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p"}],"revision":"d30737234251a69aed9057e5c7e5b17c5e7d83215013a5f8bb1eb1d416b960a1","sources":[{"modifiedAt":1793847376633,"name":"CNA: GitHub_M","retrievedAt":1793848276786,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63121"},{"modifiedAt":1793648063993,"name":"NVD","retrievedAt":1793665715257,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63121"},{"modifiedAt":1784153738000,"name":"GitHub Security Advisories","retrievedAt":1793752209831,"url":"https://github.com/kubewarden/policies/security/advisories/GHSA-8p62-9vh2-272p"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848344701,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63121"}],"ssvc":{"assessedAt":1793847366807,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules","updatedAt":1793848344701}