| Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation BreachCVE-2026-84199 · GHSA-FMQP-4WFC-W3V7Version ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Kyverno vulnerable due to usage of insecure cipherCVE-2023-54356 · GHSA-HGV6-W7R3-W4QWVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
Medium
|
Fix reported |
|
| Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)CVE-2026-84195 · GHSA-8WFP-579W-6R25Version ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRFCVE-2026-84196 · GHSA-QR4G-8HRP-C4RWVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
No fix reported |
|
| Bypassing Kyverno Policies via Double Policy ExceptionsCVE-2026-84200 · GHSA-GG4X-FGG2-H9W9Version ranges need review. |
github.com/kyverno/kyverno |
Go |
Critical
|
Fix reported |
|
| Kyverno vulnerable to SSRF via Service CallsCVE-2025-15613 · GHSA-459X-Q9HG-4GPQVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
No fix reported |
|
| kyverno seccomp control can be circumventedCVE-2023-33191 · GHSA-33HQ-F2MF-JM3CVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
Medium
|
Fix reported |
|
| Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-systemCVE-2026-54523 · GHSA-79GF-7FRW-68M9Version ranges need review. |
github.com/kyverno/kyverno |
Go |
Critical
|
Fix reported |
|
| Kyverno resource with a deletionTimestamp may allow policy circumventionCVE-2023-34091 · GHSA-HQ4M-4948-64CCVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
Medium
|
Fix reported |
|
| Attacker can cause Kyverno user to unintentionally consume insecure imageCVE-2023-47630 · GHSA-3HFQ-CX9J-923WVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data accessCVE-2026-4789 · GHSA-RGGM-JJMC-3394Version ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Kyverno Controller Denial of Service via forEach Mutation PanicCVE-2026-41485 · GHSA-FPJQ-C37H-CQCVVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)CVE-2026-41068 · GHSA-CVQ5-HHX3-F99PVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
No fix reported |
|
| kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount tokenCVE-2026-40868 · GHSA-Q93Q-V844-JRQPVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Kyverno: ServiceAccount token leaked to external servers via apiCall service URLCVE-2026-41323 · GHSA-F9G8-6PPC-PQQ4Version ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
| Denial of service from malicious manifest in kyverno in github.com/kyverno/kyvernoCVE-2023-42813 · GHSA-WC3X-5RFV-HH5V |
github.com/kyverno/kyverno |
Go |
Unknown
|
Fix reported |
|
| Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyvernoCVE-2023-42814 · GHSA-9G37-H7P2-2C6R |
github.com/kyverno/kyverno |
Go |
Unknown
|
Fix reported |
|
| Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyvernoCVE-2023-42815 · GHSA-HJPV-68F4-2262 |
github.com/kyverno/kyverno |
Go |
Unknown
|
Fix reported |
|
| Denial of service from malicious signature in kyverno in github.com/kyverno/kyvernoCVE-2023-42816 · GHSA-4MP4-46GQ-HV3R |
github.com/kyverno/kyverno |
Go |
Unknown
|
Fix reported |
|
| Kyverno's PolicyException objects can be created in any namespace by defaultCVE-2024-48921 · GHSA-QJVC-P88J-J9RMVersion ranges need review. |
github.com/kyverno/kyverno |
Go |
High
|
Fix reported |
|
