916 matches found
kyverno
Kyverno Gestión de políticas nativas de la nube 🎉 📑 Tabla de contenidos Acerca de Kyverno Objetivos no perseguidos Documentación Demos y tutoriales Casos de uso populares Explora la biblioteca de políticas Obtener ayuda Contribuir Lista de materiales de software Colaboradores Licencia Acerca de...
GO-2026-6499 vulnerabilities
Vulnerabilities for packages: tigera-operator, kube-arangodb-fips, maru, ocm-cli, cluster-api-helm-controller-fips, k8sgpt, ocm-kubernetes-controller, opentofu, flux-helm-controller, kyverno-notation-aws-fips, ocm-cli-fips, tigera-operator-fips, chaos-mesh-fips, consul-k8s, helm-exporter,...
GO-2026-6497 vulnerabilities
Vulnerabilities for packages: tigera-operator, kube-arangodb-fips, maru, ocm-cli, cluster-api-helm-controller-fips, k8sgpt, ocm-kubernetes-controller, opentofu, flux-helm-controller, kyverno-notation-aws-fips, ocm-cli-fips, tigera-operator-fips, chaos-mesh-fips, consul-k8s, helm-exporter,...
GO-2026-6497 vulnerabilities
Vulnerabilities for packages: helm-set-status, gitness, maru, cert-manager-cmctl, helm-mapkubeapis, k9s, manifest-tool, tigera-operator, flux-helm-controller, kyverno-notation-aws, rancher-helm, cluster-api-helm-controller, helm-push, k8sgpt, kargo, kube-arangodb, opentofu, xeol...
GO-2026-6499 vulnerabilities
Vulnerabilities for packages: helm-set-status, gitness, maru, cert-manager-cmctl, helm-mapkubeapis, k9s, manifest-tool, tigera-operator, flux-helm-controller, kyverno-notation-aws, rancher-helm, cluster-api-helm-controller, helm-push, k8sgpt, kargo, kube-arangodb, opentofu, xeol...
BIT-KYVERNO-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...
BIT-KYVERNO-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...
BIT-KYVERNO-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...
BIT-KYVERNO-2026-100704 Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...
BIT-KYVERNO-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...
CVE-2026-100705
A flaw was found in Kyverno. Due to missing egress network filtering in its legacy API call handler, an attacker with permission to author policies or submit templated resources can trigger Server-Side Request Forgery SSRF. This vulnerability allows the attacker to force Kyverno to issue arbitrar...
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...
CVE-2026-100707
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...
CVE-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...
EUVD-2026-87680
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...
CVE-2026-100707
Versions of Kyverno prior to 1.19.1 are vulnerable to a namespace isolation bypass within the apiCall context entry of namespaced Policy resources. The root cause is an inconsistent path interpretation between the validation and execution phases. A low-privilege tenant can exploit this by using p...
CVE-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...