A critical vulnerability was found in Kyverno, a policy engine for cloud-native platforms. Versions 1.18.0 to 1.18.1 are vulnerable to unauthorized modification and potential privilege escalation due to a flaw in the NamespacedMutatingPolicy CEL compiler. An attacker with permission to create NamespacedMutatingPolicy objects in one namespace can exploit this to create resources in another namespace, lever [truncated]
A server-side request forgery (SSRF) vulnerability exists in Kyverno before 1.16.2, specifically in the APICall feature. This allows a user with namespace-level Policy creation permissions to direct Kyverno to make HTTP requests to arbitrary internal resources. Because Kyverno executes these requests with its high-privilege ServiceAccount, the responses can be read by the attacker, potentially including s [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-01T12:17:11.220Z and has not been modified since then. Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints, vulnerable to Sweet32 attacks (CVE-2016-2183). This vulnerability could allow [truncated]
