Kyverno
Security incidents tagged Kyverno. Newest first.
1 Kyverno incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 16
- Longest quiet run: 14 days (Oct 22–Nov 4)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Kyverno: 24 advisories fixed in 1.19.2, including namespace-user-to-cluster-admin privilege escalation and image signature verification bypasses
Kyverno, the Kubernetes policy engine, fixed 24 security advisories (9 critical, 14 high, 1 moderate) in v1.19.2, released Oct 20; the CVE ids were published Nov 5. The worst bugs, rated CVSS 9.9 by the maintainers, let a user who can only create a policy in their own namespace escape it: an apiCall urlPath that hides ../ behind a ? or # separator (CVE-2026-122310, an incomplete fix of an earlier bug), CEL resource arguments and CleanupPolicy context loaders that reach other namespaces (CVE-2026-122311, CVE-2026-122304), and NamespacedMutatingPolicy mutateExisting targets that overwrite resources anywhere (CVE-2026-122303, CVE-2026-122313). Requests run as Kyverno's own ServiceAccount, which can create webhook configurations, so the maintainers say this reaches cluster admin. Other fixes cover image verification bypasses (a forged annotation, an attestation-type panic, a signature cache bypass, cosign keyless checks passing with empty SAN certificates), PolicyException and generate-rule bypasses, and several denial-of-service bugs. Multi-tenant clusters where tenants can write namespaced Kyverno policies are most at risk. Upgrade to 1.19.2 (Helm chart 3.9.2). No exploitation reported.
Kyverno (Kubernetes policy engine)Since Oct 20, 2026
