kyverno vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-100707 Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation High 8.3 · Sep 26, 2026
• CVE-2026-100706 kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace claCritical 9.4 · Sep 26, 2026
• CVE-2026-100705 Kyverno before 1.19.1 is vulnerable to server-side request forgery.High 8.3 · Sep 26, 2026
• CVE-2026-100704 Kyverno is a policy engine for Kubernetes.High 8.3 · Sep 26, 2026
• CVE-2026-100703 Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sHigh 8.3 · Sep 26, 2026
• CVE-2026-84200 Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw.Critical 9.4 · Sep 1, 2026
• CVE-2026-84196 Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requestHigh 8.3 · Sep 1, 2026
• CVE-2026-84195 Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit High 8.3 · Sep 1, 2026
• CVE-2023-54356 Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpCritical 9.3 · Sep 1, 2026
• CVE-2026-54523 Kyverno is a policy engine designed for cloud native platform engineering teams.Critical 9.6 · Aug 26, 2026
• CVE-2026-41485 Kyverno is a policy engine designed for cloud native platform engineering teams.High 7.7 · Apr 24, 2026
• CVE-2026-41323 Kyverno is a policy engine designed for cloud native platform engineering teams.High 8.1 · Apr 24, 2026
• CVE-2026-41068 Kyverno is a policy engine designed for cloud native platform engineering teams.High 7.7 · Apr 24, 2026
• CVE-2026-40868 Kyverno is a policy engine designed for cloud native platform engineering teams.High 8.1 · Apr 21, 2026
• CVE-2026-4789 Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.Critical 9.8 · Mar 30, 2026
• CVE-2026-23881 Kyverno is a policy engine designed for cloud native platform engineering teams.High 7.7 · Jan 27, 2026
• CVE-2026-22039 Kyverno is a policy engine designed for cloud native platform engineering teams.Critical 9.9 · Jan 27, 2026
• CVE-2025-47281 Kyverno is a policy engine designed for cloud native platform engineering teams.High 7.7 · Jul 23, 2025
• CVE-2025-46342 Kyverno is a policy engine designed for cloud native platform engineering teams.High 8.5 · Apr 30, 2025
• CVE-2024-48921 Kyverno is a policy engine designed for Kubernetes.High 8.7 · Oct 29, 2024
• CVE-2023-47630 Kyverno is a policy engine designed for Kubernetes.High 7.1 · Nov 14, 2023
• CVE-2022-47633 An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsiHigh 8.1 · Dec 23, 2022