Cluster add-ons
Kyverno: what changed
In the last 90 days, 15 summarized changes: 7 security advisories, 8 releases. Stackdiff reads Kyverno's own feeds (github.com) and writes two sentences per change with a link to the source; it never republishes release notes. Sources last checked .
Needs attention
Breaking changes, security advisories, end-of-life and license changes from the last 90 days, worst first.
1.18.2Securitymedium
GO-2026-6296: Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/k
1.18.2Securitymedium
GHSA-79gf-7frw-68m9: Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
Securitymedium
GO-2026-5594: Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
1.16.2Securitymedium
GO-2026-5371: Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
1.17.0Securitymedium
GO-2026-5268: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) in github.com/kyverno/kyverno
Latest changes
Newest first, every type. Releases and fixes sit below anything that can hurt you in the weekly brief; here they are in order.
1.18.2Securitymedium
GO-2026-6296: Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/k
1.18.2Securitymedium
GHSA-79gf-7frw-68m9: Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
Securitymedium
GO-2026-5594: Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
1.16.2Securitymedium
GO-2026-5371: Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
1.17.0Securitymedium
GO-2026-5268: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) in github.com/kyverno/kyverno
1.16.4Securitymedium
GHSA-fpjq-c37h-cqcv: Kyverno Controller Denial of Service via forEach Mutation Panic
1.17.0Securitymedium
GHSA-8wfp-579w-6r25: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)
1.17.0Securitymedium
GHSA-f9g8-6ppc-pqq4: Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
Securitymedium
GHSA-cvq5-hhx3-f99p: Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
1.17.0Securitymedium
GHSA-rggm-jjmc-3394: Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
1.17.0Securitymedium
GHSA-q93q-v844-jrqp: kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
1.16.2Securityhigh
GHSA-fmqp-4wfc-w3v7: Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach
Securitymedium
GHSA-qr4g-8hrp-c4rw: Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF
1.15.3Securitymedium
GHSA-r2rj-wwm5-x6mq: Kyverno Denial of Service via Context Variable Amplification in Policy Engine
1.15.3Securitycritical
GHSA-8p9x-46gm-qfx2: Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
1.13.0Securitymedium
GO-2026-4285: Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno
1.13.0Securitymedium
GHSA-gg4x-fgg2-h9w9: Bypassing Kyverno Policies via Double Policy Exceptions
1.14.2Securitymedium
GHSA-r5p3-955p-5ggq: Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service
1.13.5Securitycritical
GHSA-jrr2-x33p-6hvc: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
Securitymedium
GO-2025-3615: Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
Where Stackdiff reads Kyverno
- GitHub releases · kyverno/kyverno
- Hacker News
- OSV advisories · github.com/kyverno/kyverno
Only what the vendor publishes for machines. Excerpts are capped, summaries are our own two sentences, and every line links back.
Get Kyverno changes in your Monday brief
Add Kyverno and the rest of your stack; breaking changes and CVEs go out the moment they're seen, everything else on Monday.
Get your first brief →