Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kyverno ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und erweiterte Berechtigungen zu erlangen.
Product
Kyverno ist eine Open-Source-Richtlinien-Engine für Kubernetes, die Richtlinien als Code validiert, mutiert und generiert.
Vulnerabilities 3
-
Critical 10.0
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the Kyverno admis…
-
High 8.1
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explic…
-
High 7.7
Kyverno Controller Denial of Service via forEach Mutation Panic
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to cras…
Revision history
-
#4
Referenz(en) aufgenommen: EUVD-2026-25392, GHSA-FPJQ-C37H-CQCV
-
#3
CVE ergänzt
-
#2
CVE ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-8wfp-579w-6r25 vom 2026-04-15
https://github.com/kyverno/kyverno/security/advisories/GHSA-8wfp-579w-6r25
-
GitHub Security Advisory GHSA-cvq5-hhx3-f99p vom 2026-04-15
https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p
-
GitHub Security Advisory GHSA-f9g8-6ppc-pqq4 vom 2026-04-15
https://github.com/kyverno/kyverno/security/advisories/GHSA-f9g8-6ppc-pqq4