github.com/kyverno/kyverno (Go)
Advisories
53
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.18.2 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/kyverno/kyverno@v1.18.2 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-79gf-7frw-68m9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system |
Critical EPSS 0.47% |
>= 1.18.0, < 1.18.2 | 1.18.2 |
| GHSA-79gf-7frw-68m9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system |
Critical EPSS 0.47% |
>= 1.18.0, < 1.18.2 | 1.18.2 |
| GHSA-fpjq-c37h-cqcv Kyverno Controller Denial of Service via forEach Mutation Panic |
High EPSS 0.37% |
>= 1.13.0, < 1.16.4 | 1.16.4 |
| GHSA-fpjq-c37h-cqcv Kyverno Controller Denial of Service via forEach Mutation Panic |
High EPSS 0.37% |
>= 1.13.0, < 1.16.4>= 1.17.0-rc.1, < 1.17.2 | 1.16.41.17.2 |
| GHSA-fpjq-c37h-cqcv Kyverno Controller Denial of Service via forEach Mutation Panic |
High EPSS 0.37% |
>= 1.17.0-rc.1, < 1.17.2 | 1.17.2 |
| GHSA-8wfp-579w-6r25 Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) |
High EPSS 0.39% |
< 1.17.0 | 1.17.0 |
| GHSA-8wfp-579w-6r25 Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) |
High EPSS 0.39% |
< 1.17.0 | 1.17.0 |
| GHSA-f9g8-6ppc-pqq4 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL |
Critical EPSS 0.56% |
< 1.17.0 | 1.17.0 |
| GHSA-f9g8-6ppc-pqq4 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL |
Critical EPSS 0.56% |
< 1.17.0 | 1.17.0 |
| GHSA-cvq5-hhx3-f99p Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) |
High EPSS 0.27% |
all versions | No fix yet |
| GHSA-cvq5-hhx3-f99p Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) |
High EPSS 0.27% |
<= 1.17.1 | No fix yet |
| GHSA-q93q-v844-jrqp kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token |
High EPSS 0.29% |
< 1.17.0 | 1.17.0 |
| GHSA-q93q-v844-jrqp kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token |
High EPSS 0.29% |
< 1.17.0 | 1.17.0 |
| GHSA-fmqp-4wfc-w3v7 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach |
Medium EPSS 0.36% |
< 1.16.2 | 1.16.2 |
| GHSA-fmqp-4wfc-w3v7 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach |
Medium EPSS 0.36% |
< 1.16.2 | 1.16.2 |
| GHSA-qr4g-8hrp-c4rw Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF |
High EPSS 0.35% |
<= 1.17.1 | No fix yet |
| GHSA-qr4g-8hrp-c4rw Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF |
High EPSS 0.35% |
all versions | No fix yet |
| GHSA-qqrv-2hch-83q4 Duplicate Advisory: Kyverno is vulnerable to server-side request forgery (SSRF) Withdrawn |
Medium | >= 1.16.0, <= 1.17.1 | No fix yet |
| GHSA-rggm-jjmc-3394 Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access |
Critical EPSS 0.71% |
>= 1.16.0, < 1.17.0 | 1.17.0 |
| GHSA-rggm-jjmc-3394 Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access |
Critical EPSS 0.71% |
>= 1.16.0, < 1.17.0 | 1.17.0 |
| GHSA-r2rj-wwm5-x6mq Kyverno Denial of Service via Context Variable Amplification in Policy Engine |
Medium EPSS 0.62% |
< 1.15.3>= 1.16.0-rc.1, < 1.16.3 | 1.15.31.16.3 |
| GHSA-r2rj-wwm5-x6mq Kyverno Denial of Service via Context Variable Amplification in Policy Engine |
Medium EPSS 0.62% |
< 1.15.3 | 1.15.3 |
| GHSA-r2rj-wwm5-x6mq Kyverno Denial of Service via Context Variable Amplification in Policy Engine |
Medium EPSS 0.62% |
>= 1.16.0-rc.1, < 1.16.3 | 1.16.3 |
| GHSA-8p9x-46gm-qfx2 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall |
Critical EPSS 0.58% |
>= 1.16.0-rc.1, < 1.16.3 | 1.16.3 |
| GHSA-8p9x-46gm-qfx2 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall |
Critical EPSS 0.58% |
< 1.15.3>= 1.16.0-rc.1, < 1.16.3 | 1.15.31.16.3 |
| GHSA-8p9x-46gm-qfx2 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall |
Critical EPSS 0.58% |
< 1.15.3 | 1.15.3 |
| GHSA-gg4x-fgg2-h9w9 Bypassing Kyverno Policies via Double Policy Exceptions |
Critical EPSS 0.27% |
>= 1.9.0, < 1.13.0 | 1.13.0 |
| GHSA-gg4x-fgg2-h9w9 Bypassing Kyverno Policies via Double Policy Exceptions |
Critical EPSS 0.27% |
>= 1.9.0, < 1.13.0 | 1.13.0 |
| GHSA-r5p3-955p-5ggq Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service |
High EPSS 0.56% |
< 1.14.2 | 1.14.2 |
| GHSA-r5p3-955p-5ggq Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service |
High EPSS 0.56% |
< 1.14.2 | 1.14.2 |
| GHSA-jrr2-x33p-6hvc Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements |
High EPSS 0.77% |
< 1.13.5 | 1.13.5 |
| GHSA-jrr2-x33p-6hvc Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements |
High EPSS 0.77% |
< 1.13.5>= 1.14.0-alpha.1, < 1.14.0 | 1.13.51.14.0 |
| GHSA-jrr2-x33p-6hvc Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements |
High EPSS 0.77% |
>= 1.14.0-alpha.1, < 1.14.0 | 1.14.0 |
| GHSA-459x-q9hg-4gpq Kyverno vulnerable to SSRF via Service Calls |
Medium EPSS 0.36% |
all versions | No fix yet |
| GHSA-459x-q9hg-4gpq Kyverno vulnerable to SSRF via Service Calls |
Medium EPSS 0.36% |
<= 1.13.4 | No fix yet |
| GHSA-46mp-8w32-6g94 Kyverno ignores subjectRegExp and IssuerRegExp |
High EPSS 0.34% |
>= 1.13.0, < 1.14.0-alpha.1 | 1.14.0-alpha.1 |
| GHSA-46mp-8w32-6g94 Kyverno ignores subjectRegExp and IssuerRegExp |
High EPSS 0.34% |
< 1.14.0-alpha.1 | 1.14.0-alpha.1 |
| GHSA-qjvc-p88j-j9rm Kyverno's PolicyException objects can be created in any namespace by default |
Low EPSS 0.57% |
< 1.13.0 | 1.13.0 |
| GHSA-qjvc-p88j-j9rm Kyverno's PolicyException objects can be created in any namespace by default |
Low EPSS 0.57% |
< 1.13.0 | 1.13.0 |
| GHSA-3hfq-cx9j-923w Attacker can cause Kyverno user to unintentionally consume insecure image |
High EPSS 0.26% |
< 1.10.5 | 1.10.5 |
| GHSA-3hfq-cx9j-923w Attacker can cause Kyverno user to unintentionally consume insecure image |
High EPSS 0.26% |
< 1.10.5 | 1.10.5 |
| GO-2023-2338 Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno |
Medium EPSS 0.46% |
>= 1.5.0-rc1.0.20230601080528-80d139bb5d1d, < 1.5.0-rc1.0.20230918070231-fec2992e3f9f | 1.5.0-rc1.0.20230918070231-fec2992e3f9f |
| GO-2023-2337 Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno |
Medium EPSS 0.67% |
>= 1.5.0-rc1.0.20230601080528-80d139bb5d1d, < 1.5.0-rc1.0.20230918070231-fec2992e3f9f | 1.5.0-rc1.0.20230918070231-fec2992e3f9f |
| GO-2023-2336 Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno |
Medium EPSS 0.67% |
>= 1.5.0-rc1.0.20230601080528-80d139bb5d1d, < 1.5.0-rc1.0.20230918070231-fec2992e3f9f | 1.5.0-rc1.0.20230918070231-fec2992e3f9f |
| GO-2023-2335 Denial of service from malicious manifest in kyverno in github.com/kyverno/kyverno |
Medium EPSS 0.66% |
>= 1.5.0-rc1.0.20230601080528-80d139bb5d1d, < 1.5.0-rc1.0.20230918070231-fec2992e3f9f | 1.5.0-rc1.0.20230918070231-fec2992e3f9f |
| GHSA-hq4m-4948-64cc Kyverno resource with a deletionTimestamp may allow policy circumvention |
Medium EPSS 0.50% |
< 1.10.0 | 1.10.0 |
| GHSA-hq4m-4948-64cc Kyverno resource with a deletionTimestamp may allow policy circumvention |
Medium EPSS 0.50% |
< 1.10.0 | 1.10.0 |
| GHSA-hgv6-w7r3-w4qw Kyverno vulnerable due to usage of insecure cipher |
Critical EPSS 0.20% |
< 1.9.5 | 1.9.5 |
| GHSA-hgv6-w7r3-w4qw Kyverno vulnerable due to usage of insecure cipher |
Critical EPSS 0.20% |
< 1.9.5 | 1.9.5 |
| GHSA-33hq-f2mf-jm3c kyverno seccomp control can be circumvented |
High EPSS 0.48% |
>= 1.9.2, < 1.9.4 | 1.9.4 |
| GHSA-33hq-f2mf-jm3c kyverno seccomp control can be circumvented |
High EPSS 0.48% |
>= 1.9.2, < 1.9.4 | 1.9.4 |
| GHSA-m3cq-xcx9-3gvm kyverno verifyImages rule bypass possible with malicious proxy/registry |
High EPSS 1.05% |
>= 1.8.3, < 1.8.5 | 1.8.5 |
| GHSA-m3cq-xcx9-3gvm kyverno verifyImages rule bypass possible with malicious proxy/registry |
High EPSS 1.05% |
>= 1.8.3, < 1.8.5 | 1.8.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor