Kyverno vulnerabilities
54 CVEs and advisories name Kyverno as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124441Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kind
- CVE-2026-124440Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass
- CVE-2026-122323Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression
- CVE-2026-122322Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression
- CVE-2026-122321Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
- CVE-2026-122320Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone
- CVE-2026-122319Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic
- CVE-2026-122318Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates
- CVE-2026-122316Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting
- CVE-2026-122315Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic
- CVE-2026-122314Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic
- CVE-2026-122313Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy
- CVE-2026-122312Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String
- CVE-2026-122311Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument
- CVE-2026-122310Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath
- CVE-2026-122309Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost
- CVE-2026-122308Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest
- CVE-2026-122307Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling
- CVE-2026-122306Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching
- CVE-2026-122305Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop
- CVE-2026-122304Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader
- CVE-2026-122303Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy
- CVE-2026-122302Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
- CVE-2026-100707Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
- CVE-2026-100706kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
- CVE-2026-100705Kyverno before 1.19.1 SSRF via legacy apiCall service executor
- CVE-2026-100704Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
- CVE-2026-100703Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
- CVE-2026-84200Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
- CVE-2026-84199Kyverno before 1.16.2 SSRF via APICall Feature