en
Kyverno is a CNCF open-source project that provides a Kubernetes-native policy engine for platform engineering and security teams. It automates security, compliance, governance, and operational controls across cloud-native environments and is maintained by a worldwide community of users and contributors.
As of 11/08/2026, kyverno recorded 33 security vulnerabilities in the last 90 days across 1 products, including 31 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, kyverno had the most security vulnerabilities in the kyverno ecosystem, with 33 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124441Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target KindCVE-2026-124440Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp BypassCVE-2026-122323Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature DecompressionCVE-2026-122322Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation DecompressionCVE-2026-122321Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-124441Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kind | Exploitation statusNot confirmed | FixYes |
| Published11/08/2026 |
| SeverityHigh |
CVE-2026-124440Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/08/2026 | SeverityCritical |
|---|
CVE-2026-122323Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122322Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122321Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122320Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122319Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122318Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122316Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122315Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122314Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122313Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-122312Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122311Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-122310Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-122309Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122308Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122307Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122306Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122305Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityHigh |
|---|
CVE-2026-122304Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-122303Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-122302Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check | Exploitation statusNot confirmed | FixYes | Affected productkyverno | Published11/05/2026 | SeverityCritical |
|---|
CVE-2026-100707Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100706kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published09/26/2026 | SeverityCritical |
|---|
CVE-2026-100705Kyverno before 1.19.1 SSRF via legacy apiCall service executor | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100704Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100703Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-84200Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published09/01/2026 | SeverityCritical |
|---|
CVE-2026-84199Kyverno before 1.16.2 SSRF via APICall Feature | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published09/01/2026 | SeverityMedium |
|---|
CVE-2026-84196Kyverno before 1.18.0 Server-Side Request Forgery via apiCall | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published09/01/2026 | SeverityHigh |
|---|
CVE-2026-84195Kyverno before 1.16.4 Credential Leak via apiCall | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published09/01/2026 | SeverityHigh |
|---|
CVE-2025-15613Kyverno before v1.13.4 SSRF via Service Call | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published09/01/2026 | SeverityMedium |
|---|
CVE-2023-54356Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published09/01/2026 | SeverityCritical |
|---|
CVE-2026-54523Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published08/26/2026 | SeverityCritical |
|---|
CVE-2026-44245Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published05/12/2026 | SeverityMedium |
|---|
CVE-2026-41485Kyverno Controller Denial of Service via forEach Mutation Panic | Exploitation statusActively exploited | FixNo | Affected productkyverno | Published04/24/2026 | SeverityHigh |
|---|
CVE-2026-41323Kyverno: ServiceAccount token leaked to external servers via apiCall service URL | Exploitation statusActively exploited | FixNo | Affected productkyverno | Published04/24/2026 | SeverityHigh |
|---|
CVE-2026-41068Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published04/24/2026 | SeverityHigh |
|---|
CVE-2026-40868kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published04/21/2026 | SeverityHigh |
|---|
CVE-2026-4789CVE-2026-4789 | Exploitation statusNot exploited | FixNo | Affected productkyverno | Published03/30/2026 | SeverityCritical |
|---|
CVE-2026-23881Kyverno Denial of Service via Context Variable Amplification in Policy Engine | Exploitation statusActively exploited | FixNo | Affected productkyverno | Published01/27/2026 | SeverityHigh |
|---|
CVE-2026-22039Kyverno Cross-Namespace Privilege Escalation via Policy apiCall | Exploitation statusActively exploited | FixNo | Affected productkyverno | Published01/27/2026 | SeverityCritical |
|---|
CVE-2025-47281Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published07/23/2025 | SeverityHigh |
|---|
CVE-2025-46342Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published04/30/2025 | SeverityHigh |
|---|
CVE-2025-29778Kyverno ignores subjectRegExp and IssuerRegExp | Exploitation statusActively exploited | FixNo | Affected productkyverno | Published03/24/2025 | SeverityMedium |
|---|
CVE-2024-48921Kyverno's PolicyException objects can be created in any namespace by default | Exploitation statusActively exploited | FixYes | Affected productkyverno | Published10/29/2024 | SeverityHigh |
|---|
CVE-2023-47630Attacker can cause Kyverno user to unintentionally consume insecure image | Exploitation statusNot exploited | FixYes | Affected productkyverno | Published11/14/2023 | SeverityHigh |
|---|
CVE-2023-42816Denial of service from malicious signature in kyverno | Exploitation statusNot confirmed | FixNo | Affected productkyverno | Published11/13/2023 | SeverityMedium |
|---|
CVE-2023-42815Denial of service from malicious image manifest in kyverno | Exploitation statusNot confirmed | FixNo | Affected productkyverno | Published11/13/2023 | SeverityLow |
|---|
52 Results | Page 1 of 2