VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/kyverno/kyverno: vulnerability history, versions and safety

github.com/kyverno/kyverno is a package in the Go ecosystem. Vulert records 49 vulnerabilities for it across 120 releases, from Dec 2022 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
49 vulnerabilities recorded C3 H15 M5 U26
i
7 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
25 in the last 12 months

Most recent disclosure 27 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/kyverno/kyverno vulnerabilities

Vulert verdict on github.com/kyverno/kyverno v1.19.2 i

Updated on 23 Oct 2026

Careful: v1.19.2 has 31 known vulnerabilities, and 6 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.19.2 — affected i
  • Vulnerabilities on record 49 over 3 years · 25 in the last year i
  • Latest disclosure 27 Aug 2026 i
  • Highest CVSS 9.9 i
  • With no published fix 7 i
  • Stars 8,258 i
  • OpenSSF scorecard 8/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/kyverno/kyverno, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022154043-479d72cdd22b 22 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261022154043-479d72cdd22b 22 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261022144510-6b197a037df6 22 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261022144510-6b197a037df6 22 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261022055041-14096ce879e7 22 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261022055041-14096ce879e7 22 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021211338-bca5a8d41076 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261021211338-bca5a8d41076 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021202027-10abe965fa58 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021201117-7b1ed44f344b 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261021201117-7b1ed44f344b 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021193528-8cd979438d41 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021171957-587eb6d66969 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261021171957-587eb6d66969 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021050846-6aa52447efee 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261021050846-6aa52447efee 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261021013035-4234619e3fce 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261021013035-4234619e3fce 21 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261020210349-40a3cc7670ce 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261020210349-40a3cc7670ce 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261020183715-3726f5b55f5e 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261020183715-3726f5b55f5e 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.5 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261020034236-d6b66bf5ff08 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261020034236-d6b66bf5ff08 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261020012854-5a72abf538cd 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261020012854-5a72abf538cd 20 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261019165355-3944c1c60c83 19 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261019165355-3944c1c60c83 19 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261019145015-594e7dc09f7c 19 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261019145015-594e7dc09f7c 19 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261019044008-b51982650f30 19 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261019044008-b51982650f30 19 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261018224800-55f33b9c8bdc 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261018224800-55f33b9c8bdc 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261018134001-598651881e4a 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261018134001-598651881e4a 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261018082328-ed39528ce1aa 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261018082328-ed39528ce1aa 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261018020935-c9dc1682a9ce 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261018020935-c9dc1682a9ce 18 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261017192455-edd8b239e393 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2.0.20261017192455-edd8b239e393 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.4 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc3 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261017152648-c0f877d998dd 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.2 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261017152648-c0f877d998dd 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261017094944-79b4103f8194 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261017094944-79b4103f8194 17 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261016220045-c7e70ee9226d 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261016220045-c7e70ee9226d 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261016124348-d9730aecd920 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261016124348-d9730aecd920 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261016084651-0000e70d8671 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261016084651-0000e70d8671 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261016074401-711eb40dd5c9 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261016074401-711eb40dd5c9 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261016030757-4936fbf31d27 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261016030757-4936fbf31d27 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261016002149-6bcb483b2ba7 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261016002149-6bcb483b2ba7 16 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261015221149-a41405a4b601 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261015221149-a41405a4b601 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261015204240-cc26bc53ad32 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261015204240-cc26bc53ad32 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc.1 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261015154846-ce7e5910647a 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261015154846-ce7e5910647a 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-rc1 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261015144653-f20b010bba49 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261015144653-f20b010bba49 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261015124128-d84e174ec6e8 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261015124128-d84e174ec6e8 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261015052628-035187f1ae7c 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261015052628-035187f1ae7c 15 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261014212428-d08aaf681016 14 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261014212428-d08aaf681016 14 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261014172754-a37db25695d8 14 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261014172754-a37db25695d8 14 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261014034003-104ab6f30a43 14 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261014034003-104ab6f30a43 14 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261013231346-56906c09729b 13 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261013231346-56906c09729b 13 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261013154656-6ec11877b938 13 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261013154656-6ec11877b938 13 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261013034643-9e6f3e3e4fd1 13 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261013034643-9e6f3e3e4fd1 13 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261012222808-95f02d94c1ad 12 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261012222808-95f02d94c1ad 12 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.19.2-0.20261012222148-34d4d4d05c3c 12 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261012132901-926340195942 12 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261012132901-926340195942 12 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261010210044-5ff6a69e7a4c 10 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261010210044-5ff6a69e7a4c 10 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261010095230-eda7108cb77a 10 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261010095230-eda7108cb77a 10 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261010083828-96efcbec4f47 10 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v0.0.0-20261010082409-161cd68317c3 10 Oct 2026 C1 H12 M2 U16 Apache-2.0 No Details →
v1.5.0-rc1.0.20261010082409-161cd68317c3 10 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261009112946-f6a6a19666f1 09 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261009112946-f6a6a19666f1 09 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261009103112-c9004eb4b6a4 09 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261009103112-c9004eb4b6a4 09 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261008232045-bb82a667ccf8 08 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261008232045-bb82a667ccf8 08 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261008201146-60559b38737a 08 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261008201146-60559b38737a 08 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261008164706-577bb5b4f6e8 08 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261008164706-577bb5b4f6e8 08 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261008055704-fe09190c4fed 08 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261008055704-fe09190c4fed 08 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261007154831-ab6a6812d459 07 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261007154831-ab6a6812d459 07 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261007115200-004340052590 07 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261007115200-004340052590 07 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261007070129-88d26be5e2af 07 Oct 2026 C1 H12 M2 U16 — No Details →
v1.5.0-rc1.0.20261007070129-88d26be5e2af 07 Oct 2026 C1 H12 M2 U16 — No Details →
v0.0.0-20261006233206-82e2e774c2a7 06 Oct 2026 C1 H12 M2 U16 — No Details →

The newest 120 of 4,177 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 2
  • 2023 4
  • 2024 10
  • 2025 8
  • 2026 25

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 25 of the 49 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/kyverno/kyverno

The 5 most severe of 49 vulnerabilities recorded for this package

Search all 49 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-22039: Kyverno Critical Cross-Namespace Privilege Escalation via Policy apiCall 9.9 critical 1.15.3 27 Jan 2026
CVE-2026-54523: Kyverno Critical Vulnerability Allows Unauthorized Resource Creation Across Namespaces 9.6 critical 1.18.2 26 Aug 2026
Critical Vulnerability in Kyverno: Bypassing Policies via Double Policy Exceptions 9.0 critical 1.13.0 06 Jan 2026
CVE-2025-46342: Kyverno Namespace Selector Bypass Vulnerability 8.5 high 1.13.5 29 Apr 2025
CVE-2026-4789: Kyverno SSRF Vulnerability Allows Cross-Namespace Data Access 8.5 high 1.17.0 14 Apr 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/kyverno/kyverno

Is github.com/kyverno/kyverno safe to use?

Vulert records 49 vulnerabilities for github.com/kyverno/kyverno in Go: 3 critical, 15 high, 5 medium and 0 low, plus 26 not yet rated. 7 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/kyverno/kyverno's Vulert package health score?

Vulert scores github.com/kyverno/kyverno 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/kyverno/kyverno affected?

Yes. v1.19.2, the version you would install today, has 31 known vulnerabilities, and 6 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/kyverno/kyverno have?

49 vulnerabilities are recorded for github.com/kyverno/kyverno in the Go ecosystem: 3 critical, 15 high, 5 medium and 0 low, plus 26 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/kyverno/kyverno vulnerabilities disclosed?

25 vulnerabilities were recorded for github.com/kyverno/kyverno in the last 12 months, and the oldest entry in this database dates to 21 Dec 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/kyverno/kyverno are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/kyverno/kyverno for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/kyverno/kyverno version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.