Kyverno CVEs and Security Advisories
Kyverno has 60 published security advisories (15 critical, 31 high, 10 medium, 4 low). Below, each one lists its CVE, severity, affected and fixed versions, and a plain-language summary, taken from the official Kyverno GitHub advisories. Last checked October 23, 2026.
All advisories, newest first
| Published | Advisory | Severity | Affected | Fixed | What it means |
|---|---|---|---|---|---|
| 2026-10-23 | GHSA-39w8-hv5g-f73wkyvernoOur write-up | CriticalCVSS 9.9 | >= 1.19.1 | 1.19.2 | The apiCall namespace check added in 1.19.1 validated a decoded path but sent the raw one, so a malformed percent-escape let a namespaced Policy reach other namespaces and escalate to cluster admin. |
| 2026-10-23 | GHSA-vjfx-fp68-rh4vkyvernoOur write-up | Critical | 1.19.0 | 1.19.2 | The generate-rule authorization check was skipped when the target kind was a variable, so a tenant could make Kyverno create any kind in any namespace, such as a RoleBinding in kube-system. |
| 2026-10-21 | GHSA-5gq8-3xxc-jm92kyvernoOur write-up | CriticalCVSS 9.1 | All | v1.19.2 | An unauthenticated attacker could run commands in the project's cherry-pick GitHub workflow by commenting on a merged pull request and steal repository credentials. |
| 2026-10-21 | GHSA-q62c-r9v2-cf64kyvernoOur write-up | High | main @ 21168fdf | v1.19.2 | The generate-rule admission check tested the Kyverno controller's permissions instead of the policy author's, so namespace admins could generate resources beyond their own RBAC. |
| 2026-10-21 | GHSA-jcw5-3wcg-fqx5kyvernoOur write-up | CriticalCVSS 9.9 | >= 1.18.0 | 1.19.2 | A tenant's NamespacedMutatingPolicy could fabricate a target in another namespace or at cluster scope, which the background controller then overwrote with its privileged ServiceAccount. |
| 2026-10-21 | GHSA-p58h-r4j3-h5vxkyvernoOur write-up | CriticalCVSS 9.9 | >= 1.17.0, <= 1.19.1 | 1.19.2 | The cleanup controller ignored the policy namespace, so context entries in a namespaced CleanupPolicy escaped the namespace limits that apply to a namespaced Policy. |
| 2026-10-21 | GHSA-338x-hgrv-626hkyvernoOur write-up | HighCVSS 7.7 | <=1.19.1 | 1.19.2 | A low-privileged user could submit a resource whose data made nested variable substitution loop forever, hanging the admission webhook; this bypasses the CVE-2025-47281 fix. |
| 2026-10-21 | GHSA-8mrj-27wr-599gkyvernoOur write-up | HighCVSS 7.7 | <=1.19.1 | 1.19.2 | A namespaced policy author could supply wildcard patterns that take exponential time to match, exhausting CPU in the shared admission webhook. |
| 2026-10-21 | GHSA-h3pm-q9ww-f439kyvernoOur write-up | HighCVSS 7.7 | <=1.19.1 | 1.19.2 | A user submitting a resource could forge the annotation that carries image verification results, letting unsigned images pass ClusterPolicy verification. |
| 2026-10-21 | GHSA-qc9c-3fgf-cgq8kyvernoOur write-up | HighCVSS 7.7 | <=1.19.1 | 1.19.2 | The admissionpolicygenerator folded PolicyExceptions into generated ValidatingAdmissionPolicies without the usual exception gates, allowing a cluster-wide policy bypass. |
| 2026-10-21 | GHSA-hg5v-hwm3-956rkyvernoOur write-up | HighCVSS 8.5 | <=1.19.1 | 1.19.2 | A user able to create resources could spoof Kyverno's internal generate labels and make Kyverno generate resources on their behalf without authorization. |
| 2026-10-21 | GHSA-m8p2-qqmx-j53xkyvernoOur write-up | MediumCVSS 6.2 | <=1.19.1 | 1.19.2 | CEL policy expressions ran without a cost limit, so a namespace-tenant policy author could exhaust CPU and memory of the shared webhook and controllers. |
| 2026-10-21 | GHSA-3xfv-vq8x-qhg4kyvernoOur write-up | CriticalCVSS 9.9 | <= v1.19.1 | 1.19.2 | A namespaced Policy could hide path traversal behind a query or fragment in an apiCall urlPath, reaching any API endpoint as the admission controller and escalating to cluster admin. |
| 2026-10-21 | GHSA-4pqm-wqq6-h9q2kyvernoOur write-up | CriticalCVSS 9.9 | <= 1.19.0 | 1.19.2 | A tenant's NamespacedValidatingPolicy could use path traversal in resource.get() and resource.post() to read and write objects anywhere in the cluster. |
| 2026-10-21 | GHSA-pcx2-xcq4-65vfkyvernoOur write-up | Critical | all versions | 1.19.2 | A namespaced policy could embed another namespace in the query string of an apiCall urlPath, bypassing the namespace isolation added for CVE-2026-22039. |
| 2026-10-21 | GHSA-f96w-622v-rqpqkyvernoOur write-up | CriticalCVSS 9.9 | <= 1.19.0 | 1.19.2 | A tenant's NamespacedMutatingPolicy could name a resource in another tenant's namespace, which the background controller then mutated with its cluster-wide ServiceAccount. |
| 2026-10-21 | GHSA-x4xq-p8g4-6fwgkyvernoOur write-up | High | < 1.18.2 | 1.19.2 | Any user who can submit a resource could crash the policy engine through shallow variable substitution on a non-string field, causing denial of service or bypass under failurePolicy Ignore. |
| 2026-10-21 | GHSA-24cc-9745-hxfckyvernoOur write-up | High | < 1.18.2 | 1.19.2 | An attacker controlling an image's attestations could crash the engine, bypassing image verification under failurePolicy Ignore and crash-looping the reports controller. |
| 2026-10-21 | GHSA-vm98-8c25-h274kyvernoOur write-up | HighCVSS 8.5 | <= v1.18.2 | 1.19.2 | A tenant's NamespacedMutatingPolicy could mutate Namespace objects and resources in other namespaces using the background controller's ServiceAccount. |
| 2026-10-21 | GHSA-rcxg-3f92-3mgrkyvernoOur write-up | CriticalCVSS 9.9 | <=1.18.2 | 1.19.2 | A user able to create a namespaced CleanupPolicy could make Kyverno send arbitrary API POST requests as the cleanup controller, which can be chained to privilege escalation. |
| 2026-10-21 | GHSA-fcfr-fr8g-qjqvkyvernoOur write-up | HighCVSS 7.7 | <= 1.19.1 | 1.19.2 | When a signing certificate had no Subject Alternative Name, verifyImages skipped the subject identity check and admitted the image. |
| 2026-10-21 | GHSA-r2p2-3892-5jjfkyvernoOur write-up | High | 1.18.1 | 1.19.2 | A crafted resource could make the In or NotIn operator panic on a list with non-string values, causing denial of service in the policy engine. |
| 2026-10-21 | GHSA-493q-9xvg-9xf3kyvernoOur write-up | High | <= 1.18.1 | 1.19.2 | A namespaced generate rule could clone resources from any namespace, letting a tenant read other tenants' resources through Kyverno. |
| 2026-10-21 | GHSA-2r43-6962-xcw5kyvernoOur write-up | CriticalCVSS 9.1 | >= 1.18.0 and <= 1.19.1 | 1.19.2 | verifyImages cached results by tag rather than digest, so moving a tag after one successful check could get an unverified image admitted and pinned. |
| 2026-10-21 | GHSA-3f2c-hfj8-542wkyvernoOur write-up | HighCVSS 7.5 | >= 1.11.0, <= 1.16.2 | 1.19.2 | An attacker supplying image referrers could make Kyverno decompress an unbounded notary attestation, exhausting memory and crashing the admission controller. |
| 2026-10-21 | GHSA-fr24-3hvf-393qkyvernoOur write-up | HighCVSS 7.5 | >= 1.11.0, <= 1.16.2 | 1.19.2 | An attacker publishing image signatures could make Kyverno decompress an unbounded notary signature layer, exhausting memory and crashing the admission controller. |
| 2026-09-10 | GHSA-59v6-2x73-wfg4kyverno | HighCVSS 7.7 | >= 1.16.0, < 1.19.1 | 1.19.1 | A tenant's NamespacedValidatingPolicy could read cluster-scoped GlobalContextEntry data, including data cached from namespaces the tenant cannot access. |
| 2026-09-10 | GHSA-5cjf-wwfg-pj4ckyverno | HighCVSS 7.7 | >= 1.14.0, < 1.19.1 | 1.19.1 | A PolicyException meant to exempt specific images from an ImageValidatingPolicy exempted every image on the matched resource from signature verification. |
| 2026-09-10 | GHSA-q825-p383-r9v5kyverno | HighCVSS 7.6 | < 1.19.1 | 1.19.1 | The legacy apiCall service executor and GlobalContextEntry calls skipped the SSRF blocklist and token controls, so requests could reach metadata endpoints, loopback and internal services. |
| 2026-09-10 | GHSA-5qq8-67g6-4h2wkyverno | CriticalCVSS 9.9 | < 1.19.1 | 1.19.1 | A namespaced Policy could use percent-encoded path segments in an apiCall POST to create objects anywhere as the admission controller, escalating to cluster admin. |
| 2026-09-10 | GHSA-c5qq-7g2q-cpqpkyverno | HighCVSS 7.7 | < 1.19.1 | 1.19.1 | A namespaced Policy could use percent-encoded dot segments in an apiCall urlPath to read resources in other namespaces as the admission controller. |
| 2026-07-13 | CVE-2026-54523kyvernoOur write-up | CriticalCVSS 9.6 | v1.18.0, v1.18.1 | 1.18.2 | A tenant's NamespacedMutatingPolicy could pass any namespace to generator.apply(), making the admission controller generate resources in namespaces the tenant does not control. |
| 2026-04-29 | CVE-2026-44245policy-reporter | MediumCVSS 6.1 | < 2.5.1 | v2.5.2 | Policy Reporter UI rendered PolicyReport property values as raw HTML, allowing stored cross-site scripting in the browser of anyone viewing the report. |
| 2026-04-22 | CVE-2026-41485kyverno | HighCVSS 7.7 | >=1.13.0, <=1.17.1, <=1.16.3 | 1.17.2, 1.16.4 | A user able to create a Policy could crash the background controller into a persistent crash loop and block matching admission requests via a forEach mutation panic. |
| 2026-04-15 | CVE-2026-41323kyverno | HighCVSS 7.7 | < 1.16.4 | 1.16.4 | apiCall service calls attached the admission controller's ServiceAccount token to outbound requests by default, leaking it to external or attacker-controlled endpoints. |
| 2026-04-15 | CVE-2026-41323kyverno | HighCVSS 8.1 | < 1.16.4 | 1.16.4 | A ClusterPolicy apiCall could point to any server and receive the admission controller's ServiceAccount token, which can lead to full cluster compromise. |
| 2026-04-15 | CVE-2026-41068kyverno | HighCVSS 7.7 | <= 1.17.0 | 1.17.2 | A namespace admin could read ConfigMaps in any namespace through the configMap context loader, using Kyverno's ServiceAccount; an incomplete fix of CVE-2026-22039. |
| 2026-04-13 | GHSA-qr4g-8hrp-c4rwkyverno | HighCVSS 7.7 | 1.17.1 | 1.18.0 | Users could steer a ClusterPolicy's templated apiCall service URL to arbitrary endpoints, with responses reflected in admission errors (non-blind SSRF). |
| 2026-04-13 | CVE-2026-40868kyverno | HighCVSS 8.1 | < 1.16.4 | 1.16.4 | apiCall service calls injected the Kyverno ServiceAccount token when no Authorization header was set, sending it to whatever URL the policy named. |
| 2026-04-13 | CVE-2026-4789kyverno | HighCVSS 8.5 | >= 1.16.0, < 1.17.0 | 1.16.4 | Namespaced CEL policies could use http.Get and http.Post to reach other namespaces' services and cloud metadata endpoints from the admission controller. |
| 2026-04-13 | GHSA-fmqp-4wfc-w3v7kyverno | High | <1.16.2 | – | Users with Policy creation rights could use apiCall service URLs to reach internal resources with Kyverno's ServiceAccount, breaking multi-tenant isolation. |
| 2026-01-27 | CVE-2026-23881kyvernoOur write-up | HighCVSS 7.7 | <=1.16.2, <=1.15.2 | v1.16.3, v1.15.3 | A user able to create policies could amplify strings through chained context variables until the policy engine ran out of memory. |
| 2026-01-27 | CVE-2026-22039kyvernoOur write-up | CriticalCVSS 9.9 | <=1.16.2, <=1.15.2 | v1.16.3, v1.15.3 | A user able to create a namespaced Policy could make apiCall requests outside that namespace with the admission controller's identity, breaking namespace isolation. |
| 2026-01-06 | GHSA-gg4x-fgg2-h9w9kyverno | CriticalCVSS 9.0 | v1.9.0 - v1.12.7 | v1.13.0 | With two PolicyExceptions matching an Enforce policy, the less restrictive one could apply, letting resources bypass the policy. |
| 2025-07-22 | CVE-2025-47281kyverno | HighCVSS 7.7 | <=1.14.1 | 1.14.2 | A user able to create or update policies could crash admission controller workers with a JMESPath expression that substitutes a nil value. |
| 2025-04-29 | CVE-2025-46342kyverno | HighCVSS 8.5 | <= 1.13.4, <= 1.12.7, <= 1.11.5 | 1.14.0, 1.13.5 | A swallowed error meant rules matching on namespace selectors could silently fail to apply during admission, bypassing security mutations and validations. |
| 2025-04-15 | GHSA-459x-q9hg-4gpqkyverno | Medium | < v1.13.4 | – | A user able to create policies could use service calls to send requests to external servers they control and exfiltrate data. |
| 2025-03-24 | CVE-2025-29778kyverno | MediumCVSS 5.8 | v1.13.0 - v1.13.5 | v1.13.6, v1.14.0 | Keyless signature verification ignored subjectRegExp and issuerRegExp, so artifacts signed by an unexpected certificate could be admitted. |
| 2024-10-29 | CVE-2024-48921kyvernoOur write-up | MediumCVSS 5.9 | <1.13.0 | 1.13.0 | PolicyExceptions were accepted from any namespace by default, so users with access to ordinary namespaces could exempt their workloads from cluster policies. |
| 2023-11-13 | CVE-2023-42814kyverno | LowCVSS 3.1 | – | 1.11.0 | An attacker controlling the registry could return a malicious image manifest that crashes Kyverno's Notary verifier and blocks admission requests. |
| 2023-11-13 | CVE-2023-42813kyverno | MediumCVSS 6.1 | – | 1.11.0 | An attacker controlling the registry could return a malicious manifest to Kyverno's Notary verifier, causing denial of service for admission requests. |
| 2023-11-13 | CVE-2023-42815kyverno | LowCVSS 3.1 | – | 1.11.0 | An attacker controlling the registry could return a malicious image manifest that crashes Kyverno's Notary verifier and blocks admission requests. |
| 2023-11-13 | CVE-2023-42816kyverno | MediumCVSS 6.1 | – | 1.11.0 | An attacker controlling the registry could return a malicious signature to Kyverno's Notary verifier, causing denial of service for admission requests. |
| 2023-11-13 | CVE-2023-47630kyverno | HighCVSS 7.1 | < 1.10.5 | 1.10.5, 1.11.0 | An attacker who compromised a registry could control which image digest Kyverno users consumed, delivering a vulnerable or malicious image. |
| 2023-07-06 | GHSA-rw9c-qq4h-c24pkyverno | Low | ≤ 1.10.x | – | Image scanners flagged Sigstore rekor vulnerabilities in Kyverno up to 1.10, but the advisory states Kyverno is not susceptible to them. |
| 2023-06-01 | CVE-2023-34091kyverno | LowCVSS 6.5 | < 1.10.0 | 1.10.0 | Resources with a deletionTimestamp skipped validate, generate and mutate-existing policies, so a finalizer could be used to circumvent enforcement. |
| 2023-05-29 | GHSA-hgv6-w7r3-w4qwkyverno | Medium | ≥1.9.4 | 1.9.5, 1.10.0 | Kyverno's webhook accepted 3DES cipher suites, exposing its TLS connections to the Sweet32 attack. |
| 2023-05-25 | CVE-2023-33191kyverno | MediumCVSS 4.6 | 1.9.2-1.9.3 | 1.9.4 | The podSecurity subrule with version latest failed to enforce the baseline Seccomp control in v1.9.2 and v1.9.3. |
| 2023-03-23 | GHSA-gxr5-v2cm-3hf4kyverno | Medium | 1.9.2 | – | The Kyverno v1.9.1 image contained Go dependencies with known CVEs flagged by scanners. |
| 2022-12-21 | CVE-2022-47633kyvernoOur write-up | HighCVSS 8.1 | 1.8.3-1.8.4 | 1.8.5 | A malicious proxy or registry could bypass verifyImages signature checks in Kyverno 1.8.3 and 1.8.4. |
Staying ahead of Kyverno CVEs
Kyverno sits in the admission path of every request it handles, so a vulnerable version is worth patching quickly. Watch the GitHub advisories (or subscribe to releases on the repository), keep within one minor release of the latest, and test upgrades in a staging cluster before they reach production.
To see how many of these CVEs remain in each open source release, compared with Nirmata Enterprise for Kyverno, see the Kyverno CVE tracker. For hardening and upgrade planning, see the Kyverno Operators Playbook, our post on whether your Kyverno is actually hardened, the Production Kyverno Assessment, and Nirmata Enterprise for Kyverno.
Frequently asked questions
How do I check which Kyverno version I am running?
List the images of the Kyverno pods: kubectl get pods -n kyverno -o jsonpath="{..image}". The image tag is the version. Compare it with the Fixed column above: if your version is in an advisory's affected range, upgrade to a fixed release.
Which Kyverno versions get security fixes?
Per the Kyverno security policy, fixes land in the main branch and may be backported to one prior minor release, depending on severity and feasibility. Patch releases can be cut on demand for critical fixes. Running an older minor version usually means upgrading to get a fix. Nirmata Enterprise for Kyverno backports fixes to the current release and the four before it; the Kyverno CVE tracker compares each release with open source.
How do I report a vulnerability in Kyverno?
Email the Kyverno security response team at [email protected] with the affected versions and steps to reproduce. Don't open a public issue. The full process is in the Kyverno security policy.
Where does this data come from?
Each row is taken from the published kyverno/kyverno GitHub security advisories, with CVSS scores from NVD where the advisory has none. The list was last checked on October 23, 2026. The linked advisory is always the authoritative source.