Skip to content
OpenAdvisories

Package · Go

github.com/kyverno/kyverno

26 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-84200

    Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

    Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a res…

    kyverno kyverno github.com/kyverno/kyverno Go
  • Critical 9.6
    CVE-2026-54523 Public exploit

    Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

    Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply…

    kyverno kyverno kyverno-init-container-1.18 github.com/kyverno/kyverno Wolfi Go
  • Critical 9.8
    CVE-2026-4789

    CVE-2026-4789

    Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.

    kyverno kyverno kyverno-1.17 kyverno-cli-1.17 Wolfi Go
  • Critical 10.0
    CVE-2026-22039

    Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

    Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the Kyverno admis…

    kyverno kyverno kyverno-notation-aws github.com/kyverno/kyverno Wolfi Go