kyverno

Kyverno Cloud Native Policy Management 🎉 📑 Table of Contents About Kyverno Non-Goals Documentation Demos & Tutorials Popular Use Cases Explore the Policy Library Getting Help Contributing Software Bill of Materials Contributors License About Kyverno Kyverno is a Kubernetes-native policy engine...

CLEANSTART-2026-CV93788 Security fix for GHSA-gcjh-h69q-9w9g applied in: cluster-autoscaler-fips 1.33.6-r2, kyverno 1.16.4-r4

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

OPENSUSE-SU-2026:12214-1 kyverno-1.19.2-1.1 on GA media

These are all security issues fixed in the kyverno-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed...

BIT-KYVERNO-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

BIT-KYVERNO-2023-54356 Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites TLSECDHERSAWITH3DESEDECBCSHA and TLSRSAWITH3DESEDECBCSHA on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack CVE-2016-2183, which, over very long-lived TLS connections carrying large volumes...

CVE-2026-100706

A flaw was found in Kyverno. An authenticated user with namespace-level permissions can achieve privilege escalation to cluster administrator by supplying encoded path traversal sequences within policy requests. This vulnerability allows an attacker to bypass namespace isolation controls and crea...

GHSA-WPFX-QCH4-Q5J2 vulnerabilities

Vulnerabilities for packages: buildah-fips, prometheus-elasticsearch-exporter-fips, crossplane-provider-terraform-fips, aws-fsx-csi-driver-fips, policy-controller, crossplane-provider-gcp-beta-networksecurity-fips, flux-fips, crossplane-provider-aws-macie2-fips, crossplane-provider-aws-kinesis,...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: aactl, cert-manager, karpenter, flux, commercial-gitlab-rails-ee, commercial-nginx-ingress, consul-k8s, tempo-fips, telegraf, loki, spire-server, qemu-guesthelper, commercial-gitlab-workhorse-ee-fips, prometheus, containerd, cosign-fips, kyverno,...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, k6, rclone, argo-cd, chartmuseum, kyverno-policy-reporter-ui, terragrunt, prometheus-adapter, spire-server, grafana-pyroscope, grafana-alloy, continuity, zarf, external-dns, headlamp, karpenter, grafana, temporal-ui-server, mesosphere-vsphere-csi,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, k6, rclone, argo-cd, chartmuseum, kyverno-policy-reporter-ui, terragrunt, prometheus-adapter, spire-server, grafana-pyroscope, grafana-alloy, continuity, zarf, external-dns, headlamp, karpenter, grafana, temporal-ui-server, mesosphere-vsphere-csi,...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: step-ca, karma, telegraf, caddy, rclone, tkn, step-issuer, dapr, gitness, sftpgo, cloudflared, step-issuer-fips, buf, kyverno-policy-reporter-ui, dapr-fips, step-fips, tkn-fips, gogatekeeper, step-ca-fips, caddy-fips, kyverno-policy-reporter-ui-fips, rclone-fips, ste...

GHSA-XCVF-46F4-XWXF vulnerabilities

Vulnerabilities for packages: buf, rclone, sftpgo, step, tkn, kyverno-policy-reporter-ui, cloudflared, gogatekeeper, step-ca, gitness, caddy, karma, step-issuer...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: buf, rclone, sftpgo, step, tkn, kyverno-policy-reporter-ui, cloudflared, gogatekeeper, step-ca, gitness, caddy, karma, step-issuer...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, ocm-kubernetes-controller, tigera-operator-fips, redpanda-operator, kube-arangodb, cluster-api-helm-controller-fips, envoy-gateway-fips, chaos-mesh-fips, consul-k8s, helm-set-status, ocm-cli, ocm-cli-fips, xeol, k8sgpt, kyverno-notation-aws-fips,...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, ocm-kubernetes-controller, tigera-operator-fips, redpanda-operator, kube-arangodb, cluster-api-helm-controller-fips, envoy-gateway-fips, chaos-mesh-fips, consul-k8s, helm-set-status, ocm-cli, ocm-cli-fips, xeol, k8sgpt, kyverno-notation-aws-fips,...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: xeol, k8sgpt, flux-helm-controller, helm-push, cluster-api-helm-controller, manifest-tool, kyverno-notation-aws, cert-manager-cmctl, maru, tigera-operator, gitness, helm-set-status, kargo, kube-arangodb, rancher-helm, opentofu, helm-mapkubeapis, k9s...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: xeol, k8sgpt, flux-helm-controller, helm-push, cluster-api-helm-controller, manifest-tool, kyverno-notation-aws, cert-manager-cmctl, maru, tigera-operator, gitness, helm-set-status, kargo, kube-arangodb, rancher-helm, opentofu, helm-mapkubeapis, k9s...

BIT-KYVERNO-2026-100707 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and...

BIT-KYVERNO-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

BIT-KYVERNO-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...