github.com/kyverno/kyverno vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-41485Highgithub.com/kyverno/kyverno: Kyverno Controller Denial of Service via forEach Mutation Panic GHSA-8WFP-579W-6R25Highgithub.com/kyverno/kyverno: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)CVE-2026-41323Highgithub.com/kyverno/kyverno: Kyverno: ServiceAccount token leaked to external servers via apiCall service URL CVE-2026-41068Highgithub.com/kyverno/kyverno: Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)CVE-2026-4789Highgithub.com/kyverno/kyverno: Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace…CVE-2026-40868Highgithub.com/kyverno/kyverno: kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token GHSA-FMQP-4WFC-W3V7Highgithub.com/kyverno/kyverno: Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach GHSA-QR4G-8HRP-C4RWHighgithub.com/kyverno/kyverno: Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF CVE-2026-23881Highgithub.com/kyverno/kyverno: Kyverno Denial of Service via Context Variable Amplification in Policy Engine CVE-2026-22039Criticalgithub.com/kyverno/kyverno: Kyverno Cross-Namespace Privilege Escalation via Policy apiCall GHSA-GG4X-FGG2-H9W9Criticalgithub.com/kyverno/kyverno: Bypassing Kyverno Policies via Double Policy Exceptions CVE-2025-47281Highgithub.com/kyverno/kyverno: Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service CVE-2025-46342Highgithub.com/kyverno/kyverno: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements GHSA-459X-Q9HG-4GPQHighgithub.com/kyverno/kyverno: Kyverno vulnerable to SSRF via Service Calls CVE-2025-29778Mediumgithub.com/kyverno/kyverno: Kyverno ignores subjectRegExp and IssuerRegExp CVE-2024-48921Highgithub.com/kyverno/kyverno: Kyverno's PolicyException objects can be created in any namespace by default CVE-2023-47630Highgithub.com/kyverno/kyverno: Attacker can cause Kyverno user to unintentionally consume insecure image CVE-2023-34091Mediumgithub.com/kyverno/kyverno: Kyverno resource with a deletionTimestamp may allow policy circumvention GHSA-HGV6-W7R3-W4QWMediumgithub.com/kyverno/kyverno: Kyverno vulnerable due to usage of insecure cipher CVE-2023-33191Mediumgithub.com/kyverno/kyverno: kyverno seccomp control can be circumvented CVE-2022-47633Highgithub.com/kyverno/kyverno: kyverno verifyImages rule bypass possible with malicious proxy/registry

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo