Kyverno is a Kubernetes policy engine and admission controller that enforces security and compliance rules across container orchestration environments, making its vulnerabilities significant to cloud-native infrastructure despite a narrow product scope. Its documented exposure skews toward serious outcomes, clustering around server-side request forgery, resource exhaustion, sensitive information disclosure, and authentication and authorization weaknesses that reflect the trust boundary and API-mediated control plane inherent to a policy enforcement layer. Defenders should treat Kyverno security updates as high-priority for any cluster relying on policy enforcement; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Kyverno over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-22039CRITICAL Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyv | Jan 27, 2026 | 9.9 | 36 | NO | NO |
CVE-2026-41323CRITICAL Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy au | Apr 24, 2026 | 9.1 | 34 | NO | NO |
CVE-2026-4789CRITICAL Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions. | Mar 30, 2026 | 9.8 | 32 | NO | NO |
CVE-2026-41485HIGH Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler | Apr 24, 2026 | 7.7 | 30 | NO | NO |
CVE-2026-41068HIGH Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` cont | Apr 24, 2026 | 7.7 | 30 | NO | NO |
CVE-2026-40868HIGH Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... | Apr 21, 2026 | 8.1 | 28 | NO | NO |
CVE-2022-47633HIGH An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary conta | Dec 23, 2022 | 8.1 | 26 | NO | NO |
CVE-2026-44245MEDIUM Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HT | May 12, 2026 | 6.1 | 25 | NO | NO |
CVE-2025-47281HIGH Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handli | Jul 23, 2025 | 7.7 | 25 | NO | NO |
CVE-2025-46342HIGH Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in | Apr 30, 2025 | 8.2 | 24 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Kyverno.
Media articles that mention a CVE ID that affects a product developed by Kyverno — matched by CVE ID, not by vendor name.