GO-2026-6499 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, cert-manager-cmctl, helm-exporter-fips, k9s, cluster-api-helm-controller, chaos-mesh-fips, cloudbeat-fips, consul-k8s-fips, kyverno, tigera-operator-fips, gitness, helm-mapkubeapis, maru, rancher-helm, helm-push, manifest-tool, kube-arangodb,...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, cert-manager-cmctl, helm-exporter-fips, k9s, cluster-api-helm-controller, chaos-mesh-fips, cloudbeat-fips, consul-k8s-fips, kyverno, tigera-operator-fips, gitness, helm-mapkubeapis, maru, rancher-helm, helm-push, manifest-tool, kube-arangodb,...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, manifest-tool, rancher-helm, gitness, k8sgpt, kyverno-notation-aws, cluster-api-helm-controller, cert-manager-cmctl, helm-mapkubeapis, k9s, maru, xeol, tigera-operator, kargo, kube-arangodb, opentofu, helm-set-status, helm-push...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, manifest-tool, rancher-helm, gitness, k8sgpt, kyverno-notation-aws, cluster-api-helm-controller, cert-manager-cmctl, helm-mapkubeapis, k9s, maru, xeol, tigera-operator, kargo, kube-arangodb, opentofu, helm-set-status, helm-push...

kyverno

Kyverno Cloud Native Policy Management 🎉 📑 Table of Contents About Kyverno Non-Goals Documentation Demos & Tutorials Popular Use Cases Explore the Policy Library Getting Help Contributing Software Bill of Materials Contributors License About Kyverno Kyverno is a Kubernetes-native policy engine...

BIT-KYVERNO-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...

BIT-KYVERNO-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

BIT-KYVERNO-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

BIT-KYVERNO-2026-100704 Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

CVE-2026-100705

A flaw was found in Kyverno. Due to missing egress network filtering in its legacy API call handler, an attacker with permission to author policies or submit templated resources can trigger Server-Side Request Forgery SSRF. This vulnerability allows the attacker to force Kyverno to issue arbitrar...

CVE-2026-100704

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

CVE-2026-100703

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100705

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100706

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100707

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...

CVE-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...

CVE-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...

EUVD-2026-87680

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...

CVE-2026-100707

Versions of Kyverno prior to 1.19.1 are vulnerable to a namespace isolation bypass within the apiCall context entry of namespaced Policy resources. The root cause is an inconsistent path interpretation between the validation and execution phases. A low-privilege tenant can exploit this by using p...

CVE-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...