Vulnerability GO-2026-6296
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
August 27, 2026 at 07:52 PM UTC
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno
v1.18.0 - v1.18.2-rc.1
v1.18.0 - v1.18.2-rc.1
Summary
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno
Details
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
1 month ago
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
v1.18.0 - v1.18.2-rc.1 GHSA-79gf-7frw-68m9
v1.18.0 - v1.18.2-rc.1 GHSA-79gf-7frw-68m9
Unknown
3 months ago
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
v0.1.0 - v1.17.0-rc.3 GO-2026-5575
v0.1.0 - v1.17.0-rc.3 GO-2026-5575
Unknown
3 months ago
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
v0.1.0 - v1.19.1 GO-2026-5594
v0.1.0 - v1.19.1 GO-2026-5594
Unknown
3 months ago
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno
v1.16.0 - v1.17.0-rc.3 GO-2026-5621
v1.16.0 - v1.17.0-rc.3 GO-2026-5621
Unknown
3 months ago
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) in github.com/kyverno/kyverno
v0.1.0 - v1.19.1 GO-2026-5337
v0.1.0 - v1.19.1 GO-2026-5337
Impacted packages
Timeline
Published
1 month ago
August 27, 2026 at 07:52 PM UTC
Last Modified
1 month ago
September 02, 2026 at 04:25 PM UTC