kyverno vulnerabilities and CVEs

Known vulnerabilities affecting kyverno, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

21 vulnerabilities tracked.

• 9.4 Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in… CVE-2026-122313 5 Nov 2026
• 9.4 Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing… CVE-2026-122311 5 Nov 2026
• 9.4 Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment… CVE-2026-122310 5 Nov 2026
• 9.4 Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in… CVE-2026-122303 5 Nov 2026
• 9.4 Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace… CVE-2026-122304 5 Nov 2026
• 9.3 Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC… CVE-2026-122302 5 Nov 2026
• 8.7 Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust… CVE-2026-122323 5 Nov 2026
• 8.7 Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to… CVE-2026-122322 5 Nov 2026
• 8.7 Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy… CVE-2026-122319 5 Nov 2026
• 8.7 Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy… CVE-2026-122315 5 Nov 2026
• 8.7 Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources… CVE-2026-122314 5 Nov 2026
• 8.5 Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the… CVE-2026-122321 5 Nov 2026
• 8.4 Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows… CVE-2026-122316 5 Nov 2026
• 8.4 Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update… CVE-2026-122308 5 Nov 2026
• 8.3 Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other… CVE-2026-122320 5 Nov 2026
• 8.3 Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because… CVE-2026-122312 5 Nov 2026
• 8.3 Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into… CVE-2026-122307 5 Nov 2026
• 8.3 Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU… CVE-2026-122306 5 Nov 2026
• 8.3 Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the… CVE-2026-122305 5 Nov 2026
• 8.2 Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by… CVE-2026-122309 5 Nov 2026
• 7.2 Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks… CVE-2026-122318 5 Nov 2026