Vulnerability GO-2026-5575
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 10:34 PM UTC
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
v0.1.0 - v1.17.0-rc.3
v0.1.0 - v1.17.0-rc.3
Summary
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
Details
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno
v1.18.0 - v1.18.2-rc.1 GO-2026-6296
v1.18.0 - v1.18.2-rc.1 GO-2026-6296
Critical
1 month ago
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
v1.18.0 - v1.18.2-rc.1 GHSA-79gf-7frw-68m9
v1.18.0 - v1.18.2-rc.1 GHSA-79gf-7frw-68m9
Unknown
3 months ago
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
v0.1.0 - v1.19.1 GO-2026-5594
v0.1.0 - v1.19.1 GO-2026-5594
Unknown
3 months ago
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno
v1.16.0 - v1.17.0-rc.3 GO-2026-5621
v1.16.0 - v1.17.0-rc.3 GO-2026-5621
Unknown
3 months ago
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) in github.com/kyverno/kyverno
v0.1.0 - v1.19.1 GO-2026-5337
v0.1.0 - v1.19.1 GO-2026-5337
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 10:34 PM UTC
Last Modified
3 months ago
June 25, 2026 at 11:11 PM UTC