# github.com/kyverno/kyverno (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-kyverno-kyverno Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-kyverno-kyverno.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 27 vulnerabilities in github.com/kyverno/kyverno (Go): 0 in the last 7 days and 7 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-84200, was published on 1 September 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 7 - All time: 27 (2 critical, 0 exploited in the wild) ## About github.com/kyverno/kyverno (Go) Kubernetes policy engine that validates and enforces policies for cluster resources. ## Latest github.com/kyverno/kyverno (Go) vulnerabilities - [CVE-2026-84200: Kyverno policy bypass via multiple exceptions](https://junglewise.ai/threats/cve-2026-84200-kyverno-policy-bypass-via-multiple-exceptions) (critical, CVSS 9, published 1 Sep 2026) - [CVE-2026-84199: Kyverno APICall server-side request forgery (SSRF) via unvalidated URL](https://junglewise.ai/threats/cve-2026-84199-kyverno-apicall-server-side-request-forgery-ssrf-via-unvalidated) (high, CVSS 7.7, published 1 Sep 2026) - [CVE-2026-84196: Kyverno server-side request forgery in apiCall](https://junglewise.ai/threats/cve-2026-84196-kyverno-server-side-request-forgery-in-apicall) (high, CVSS 7.7, published 1 Sep 2026) - [CVE-2026-84195: Kyverno apiCall credential leak to external endpoints](https://junglewise.ai/threats/cve-2026-84195-kyverno-apicall-credential-leak-to-external-endpoints) (high, CVSS 7.7, published 1 Sep 2026) - [CVE-2025-15613: Kyverno server-side request forgery via Service Calls](https://junglewise.ai/threats/cve-2025-15613-kyverno-server-side-request-forgery-via-service-calls) (medium, CVSS 6.5, published 1 Sep 2026) - [CVE-2023-54356: Kyverno weak cipher suite support in TLS](https://junglewise.ai/threats/cve-2023-54356-kyverno-weak-cipher-suite-support-in-tls) (low, CVSS 3.7, published 1 Sep 2026) - [CVE-2026-54523: Kyverno NamespacedMutatingPolicy generator.apply() namespace validation bypass](https://junglewise.ai/threats/cve-2026-54523-kyverno-namespacedmutatingpolicy-generator-apply-namespace) (critical, CVSS 9.6, published 26 Aug 2026) - [CVE-2026-41485: Kyverno Controller Denial of Service via forEach Mutation Panic](https://junglewise.ai/threats/cve-2026-41485-kyverno-controller-denial-of-service-via-foreach-mutation-panic) (high, CVSS 7.7, published 24 Apr 2026) - [CVE-2026-41323: Kyverno: ServiceAccount token leaked to external servers via apiCall service URL](https://junglewise.ai/threats/cve-2026-41323-kyverno-serviceaccount-token-leaked-to-external-servers-via) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-41068: Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for fixed cross-namespace…](https://junglewise.ai/threats/cve-2026-41068-kyverno-cross-namespace-read-bypasses-rbac-isolation-incomplete) (high, CVSS 7.7, published 24 Apr 2026) - [CVE-2026-40868: kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token](https://junglewise.ai/threats/cve-2026-40868-kyverno-apicall-servicecall-implicit-bearer-token-injection-leaks) (high, CVSS 8.1, published 21 Apr 2026) - [CVE-2026-4789: Kyverno SSRF in CEL HTTP library functions](https://junglewise.ai/threats/cve-2026-4789-kyverno-ssrf-in-cel-http-library-functions) (high, CVSS 8.5, published 14 Apr 2026) - [Kyverno SSRF via unrestricted CEL HTTP functions](https://junglewise.ai/threats/kyverno-ssrf-via-unrestricted-cel-http-functions-d54eaa1c) (medium, CVSS 9.8, published 30 Mar 2026) - [CVE-2026-23881: GO-2026-4382 - Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2026-23881-kyverno-denial-of-service-via-context-variable-amplification-in) (low, CVSS 3.1, published 2 Feb 2026) - [CVE-2026-22039: GO-2026-4381 - Kyverno Cross-Namespace Privilege Escalation via Policy apiCall in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2026-22039-kyverno-cross-namespace-privilege-escalation-via-policy-apicall) (low, CVSS 3.1, published 2 Feb 2026) - [CVE-2025-47281: GO-2025-3823 - Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2025-47281-kyverno-s-improper-jmespath-variable-evaluation-lead-to-denial-of) (low, CVSS 3.1, published 29 Jul 2025) - [CVE-2025-46342: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements](https://junglewise.ai/threats/cve-2025-46342-kyverno-vulnerable-to-bypass-of-policy-rules-that-use-namespace) (low, CVSS 3.1, published 5 May 2025) - [CVE-2025-29778: GO-2025-3562 - Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2025-29778-kyverno-ignores-subjectregexp-and-issuerregexp) (low, CVSS 3.1, published 25 Mar 2025) - [CVE-2024-48921: GO-2024-3230 - Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2024-48921-kyverno-s-policyexception-objects-can-be-created-in-any-namespace) (low, CVSS 3.1, published 30 Oct 2024) - [CVE-2023-47630: GO-2023-2340 - Attacker can cause Kyverno user to unintentionally consume insecure image in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2023-47630-attacker-can-cause-kyverno-user-to-unintentionally-consume) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-42815: GO-2023-2337 - Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2023-42815-go-2023-2337-denial-of-service-from-malicious-image-manifest-in) (info, published 21 Aug 2024) - [CVE-2023-42816: GO-2023-2338 - Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2023-42816-go-2023-2338-denial-of-service-from-malicious-signature-in) (info, published 21 Aug 2024) - [CVE-2023-42814: GO-2023-2336 - Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2023-42814-go-2023-2336-denial-of-service-from-malicious-image-manifest-in) (info, published 21 Aug 2024) - [CVE-2023-42813: GO-2023-2335 - Denial of service from malicious manifest in kyverno in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2023-42813-go-2023-2335-denial-of-service-from-malicious-manifest-in-kyverno) (info, published 21 Aug 2024) - [CVE-2023-33191: GO-2023-1801 - kyverno seccomp control can be circumvented in github.com/kyverno/kyverno](https://junglewise.ai/threats/cve-2023-33191-kyverno-seccomp-control-can-be-circumvented) (low, CVSS 3.1, published 20 Aug 2024) ## Most severe github.com/kyverno/kyverno (Go) vulnerabilities - [CVE-2026-54523: Kyverno NamespacedMutatingPolicy generator.apply() namespace validation bypass](https://junglewise.ai/threats/cve-2026-54523-kyverno-namespacedmutatingpolicy-generator-apply-namespace) (critical, CVSS 9.6, published 26 Aug 2026) - [CVE-2026-84200: Kyverno policy bypass via multiple exceptions](https://junglewise.ai/threats/cve-2026-84200-kyverno-policy-bypass-via-multiple-exceptions) (critical, CVSS 9, published 1 Sep 2026) - [CVE-2026-4789: Kyverno SSRF in CEL HTTP library functions](https://junglewise.ai/threats/cve-2026-4789-kyverno-ssrf-in-cel-http-library-functions) (high, CVSS 8.5, published 14 Apr 2026) - [CVE-2026-41323: Kyverno: ServiceAccount token leaked to external servers via apiCall service URL](https://junglewise.ai/threats/cve-2026-41323-kyverno-serviceaccount-token-leaked-to-external-servers-via) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-40868: kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token](https://junglewise.ai/threats/cve-2026-40868-kyverno-apicall-servicecall-implicit-bearer-token-injection-leaks) (high, CVSS 8.1, published 21 Apr 2026) - [CVE-2026-84195: Kyverno apiCall credential leak to external endpoints](https://junglewise.ai/threats/cve-2026-84195-kyverno-apicall-credential-leak-to-external-endpoints) (high, CVSS 7.7, published 1 Sep 2026) - [CVE-2026-41485: Kyverno Controller Denial of Service via forEach Mutation Panic](https://junglewise.ai/threats/cve-2026-41485-kyverno-controller-denial-of-service-via-foreach-mutation-panic) (high, CVSS 7.7, published 24 Apr 2026) - [CVE-2026-84199: Kyverno APICall server-side request forgery (SSRF) via unvalidated URL](https://junglewise.ai/threats/cve-2026-84199-kyverno-apicall-server-side-request-forgery-ssrf-via-unvalidated) (high, CVSS 7.7, published 1 Sep 2026) - [CVE-2026-84196: Kyverno server-side request forgery in apiCall](https://junglewise.ai/threats/cve-2026-84196-kyverno-server-side-request-forgery-in-apicall) (high, CVSS 7.7, published 1 Sep 2026) - [CVE-2026-41068: Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for fixed cross-namespace…](https://junglewise.ai/threats/cve-2026-41068-kyverno-cross-namespace-read-bypasses-rbac-isolation-incomplete) (high, CVSS 7.7, published 24 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 0 | | 31 Aug 2026 | 6 | 1 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/kyverno/kyverno (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-kyverno-kyverno, 13 November 2026.