Most recent entries from all

BIT-kyverno-2025-46342 — Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

2026-10-02T16:54:50.230614+00:00

Affected: Bitnami: kyverno

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

Withdrawn: CLEANSTART-2026-UQ68343 — During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cer…

2026-10-02T16:54:50.230667+00:00

Withdrawn by the publisher.

Affected: CleanStart: kyverno-policy-reporter-kyverno-plugin-fips

Multiple security vulnerabilities affect the kyverno-policy-reporter-kyverno-plugin-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.

EUVD-2026-235927

2026-10-02T16:54:50.230693+00:00

EUVD-2026-235927

fkie_cve-2025-46342

2026-10-02T16:54:50.230707+00:00

GHSA-jrr2-x33p-6hvc — Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

2026-10-02T16:54:50.230730+00:00

Affected: Go: github.com/kyverno/kyverno

### Summary

Due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go` it may happen that policy rules using namespace selector(s) in their `match` statements are mistakenly not applied during admission review request processing. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations.

### Details

As a policy engine Kyverno is a critical component ensuring the security of Kubernetes clusters by apply security-relevant policy rules in the Kubernetes admission control process.

We encountered a case where Kyverno did not apply policy rules which should have been applied. This happened in both the mutation and the validation phase of admission control. Effectively Kyverno handled the admission review requests as if those policy rules did not exist. Consequently, the Kube API request was accepted without applying security-relevant patches and validations.

As the root cause we identified a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go` ([src][1]).

All affected policy rules use a namespace selector in their match resource filters like this:

```yaml match: all: - resources: namespaceSelector: matchExpressions: - key: label1 operator: Exists ```

Such specification intents to apply rules only to resource object…

openSUSE-SU-2025:15059-1 — govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media

2026-10-02T16:54:50.230779+00:00

govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media