kyverno vulnerabilities and fixes
Exploited and high-severity kyverno vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.7CVE-2026-122323Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature DecompressionFix availablekyverno kyverno
1 min read - 8.5CVE-2026-122321Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification BypassFix availablekyverno kyverno
1 min read - 8.7CVE-2026-122322Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation DecompressionFix availablekyverno kyverno
1 min read - 8.3CVE-2026-122320Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.cloneFix availablekyverno kyverno
1 min read - 8.7CVE-2026-122319Kyverno before 1.19.2 Denial of Service via In/NotIn Operator PanicFix availablekyverno kyverno
1 min read - 8.4CVE-2026-122316Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExistingFix availablekyverno kyverno
1 min read - 7.2CVE-2026-122318Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN CertificatesFix availablekyverno kyverno
1 min read - 8.7CVE-2026-122315Kyverno before 1.19.2 Image Verification Bypass via Attestation Type PanicFix availablekyverno kyverno
1 min read - 9.4CVE-2026-122313Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicyFix availablekyverno kyverno
1 min read - 8.7CVE-2026-122314Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution PanicFix availablekyverno kyverno
1 min read - 8.3CVE-2026-122312Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query StringFix availablekyverno kyverno
1 min read - 9.4CVE-2026-122311Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argumentFix availablekyverno kyverno
1 min read - 8.2CVE-2026-122309Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation CostFix availablekyverno kyverno
1 min read - 9.4CVE-2026-122310Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPathCloudFix availablekyverno kyverno
1 min read - 8.4CVE-2026-122308Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequestFix availablekyverno kyverno
1 min read - 8.3CVE-2026-122306Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard MatchingFix availablekyverno kyverno
1 min read - 8.3CVE-2026-122307Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException HandlingFix availablekyverno kyverno
1 min read - 8.3CVE-2026-122305Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution LoopFix availablekyverno kyverno
1 min read - 9.4CVE-2026-122303Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicyFix availablekyverno kyverno
1 min read - 9.4CVE-2026-122304Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context LoaderFix availablekyverno kyverno
1 min read - 9.3CVE-2026-122302Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission CheckFix availablekyverno kyverno
1 min read