polaris

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

CVE-2026-122323

A flaw was found in Kyverno. An attacker who controls container registry referrers or signatures can trigger a Denial of Service DoS by supplying specially crafted, highly compressed signature layers. When Kyverno decompresses these payloads, it fails to enforce size limits, resulting in memory...

CVE-2026-122322

A flaw was found in Kyverno. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exhausting system memory. By supplying specially crafted, highly compressed attestation layers in container registry artifacts, an attacker triggers unbounded decompression within the...

CVE-2026-122306

A flaw was found in Kyverno. An authenticated attacker with policy creation privileges can cause a Denial of Service DoS by submitting policies containing crafted wildcard patterns. When evaluated, these complex patterns consume excessive processor resources, resulting in admission controller...

CVE-2026-122311

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get and resource.post, allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster...

CVE-2026-122306

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict,...

EUVD-2026-117217

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict,...

CVE-2026-122306

Kyverno versions before 1.19.2 are vulnerable to a Denial of Service attack due to Inefficient Algorithmic Complexity (CWE-407) during wildcard matching. Namespaced policy authors can exhaust the admission controller's CPU by submitting pathological wildcard patterns . Specifically, crafting a Po...

PT-2026-137328

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict,...

CVE-2025-1974

🚨 Log Injection Test via Ingress-NGINX Admission Controller 🧠 Overview This script tests for annotation injection vulnerabilities in Kubernetes clusters using the NGINX Ingress Controller. It is meant for detection purposes only in relation to CVE-2025-1974, which allows malicious annotations to...

IngressNightmare-RCE-POC

⚠️ Critical RCE in Ingress-NGINX via Configuration Injection CVE-2025-1974 and more This repository contains a proof-of-concept PoC exploit for CVE-2025-1974 , a Critical CVSS 9.8 vulnerability in the Ingress-NGINX controller for Kubernetes. This flaw allows unauthenticated remote code execution...

trivy-enforcer

trivy-enforcer EXPERIMENTAL Kubernetes Operator for Image Assurance It works as Admission Controller protecting unsafe images from being deployed Custom Controller watching ImageVulnerability CRD and scanning the image in the custom resource automatically Setup $ kubectl apply -f manifests/opa.ya...

CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Kubernetes Admission Controller Bypass via Case Sensitivity Program Code Python admission webhook + exploit !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask, request, jsonify app = Flaskname DENIEDPODNAMES ...

IngressNightmare-PoC

Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. Research by Wiz In the original research, the Wi...

CVE-2025-1974

Kubernetes Ingress-NGINX Unauthenticated Remote Code Execution CVE-2025-1974 Ingress-NGINX: An ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer The "IngressNightmare" vulnerability CVE-2025-1974 stems from a critical flaw in the Ingress-NGINX Admission Controller...

CVE-2025-1974

cve-2025-1974-win11-attack-defense-lab Windows 11-first educational repository for studying CVE-2025-1974 in a safe, non-weaponized ATTACK + DEFENSE lab. The project is designed for university coursework, team demos, and report-ready screenshots. It emphasizes clean-room implementation, local-onl...

CVE-2025-1974

DEMO https://youtu.be/3hYlHeaf2mQ What is CVE-2025-1974? CVE-2025-1974 IngressNightmare is a critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in the Kubernetes ingress-nginx admission controller. Attack Flow: 1. Upload : Send malicious shared library .so file to NGINX via HTT...

Exploit for CVE-2026-54523

SG-2026-0037 PoC This package reproduces the namespace-bounda...

CVE-2025-1974

CVE-2025-1974 White Hat School 3rd Cohort - Kim So-eun @salt318 https://github.com/salt318/vulhub Summary Caused by a defect in the Ingress-NGINX Admission Controller, a core security mechanism of Kubernetes The Ingress-NGINX Admission Controller is exposed to the network without authentication...

CLEANSTART-2026-EL01071 vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to ...

CVE-2025-5187 affects multiple packages. A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. See references for individual...