CVE-2026-63121

The record

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.

Affected packages

Related vulnerabilities

• CVE-2026-109411 An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's… CWE-178
• CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from… CWE-178
• CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. CWE-178
• CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP feed distribution, contains a… CWE-178
• CVE-2026-114132 Nuxt is an open-source web development framework for Vue.js. CWE-178
• CVE-2026-109841 undici is an HTTP client library for Node.js. CWE-178
• CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. CWE-178
• CVE-2026-87876 Two case-insensitive comparisons on request-derived usernames outside the main… CWE-178