TI-2026-17733 CVE-2026-22039 · GHSA-8p9x-46gm-qfx2
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
Priority HIGH 76
Kyverno is a policy engine designed for cloud native platform engineering teams.
kyverno
Records53All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical13CVSS 9.0–10.0
CVSS high32CVSS 7.0–8.9
Exploited now
kyverno records in CISA KEVNo kyverno vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Kyverno · all components
TI-2026-29924 CVE-2026-41323 · GHSA-f9g8-6ppc-pqq4
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
Priority HIGH 74
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2026-29524 CVE-2026-40868 · GHSA-q93q-v844-jrqp
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Priority HIGH 70
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2025-21189 CVE-2025-29778 · GHSA-46mp-8w32-6g94
Kyverno ignores subjectRegExp and IssuerRegExp
Priority HIGH 68
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2026-30072 CVE-2026-41485 · GHSA-fpjq-c37h-cqcv
Kyverno Controller Denial of Service via forEach Mutation Panic
Priority HIGH 67
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2026-29707 CVE-2026-41068 · GHSA-cvq5-hhx3-f99p
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
Priority HIGH 67
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2026-19239 CVE-2026-23881 · GHSA-r2rj-wwm5-x6mq
Kyverno Denial of Service via Context Variable Amplification in Policy Engine
Priority HIGH 67
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2025-29811 CVE-2025-47281 · GHSA-r5p3-955p-5ggq
Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service
Priority HIGH 67
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2026-04177 CVE-2026-4789 · GHSA-rggm-jjmc-3394
Server-side request forgery in Kyverno
Priority MEDIUM 50
Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.
TI-2025-29083 CVE-2025-46342 · GHSA-jrr2-x33p-6hvc
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
Priority MEDIUM 41
Kyverno is a policy engine designed for cloud native platform engineering teams.
TI-2022-23661 CVE-2022-47633 · GHSA-m3cq-xcx9-3gvm
An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a…
Priority LOW 39
An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes…
TI-2023-25772 CVE-2023-47630 · GHSA-3hfq-cx9j-923w
Attacker can cause Kyverno user to unintentionally consume insecure image
Priority LOW 33
Kyverno is a policy engine designed for Kubernetes.