RATATOSKRATATOSK
Sign in

Kubescape

v4.0.11Security
Jul 22, 2026

Kubescape v4.0.11 adds CEL control execution, VAP bundle vendoring, MCP server scanning capabilities, and new adaptors. Three behavior changes in air-gapped mode, exception flags, and image exception output require operator attention; all fixes ship in v4.0.11.

  • breakingAir-gapped mode fix: explicit offline flag threading

    Air-gapped mode now correctly threads an explicit offline flag to policy getters instead of relying on nil. If you rely on air-gapped mode, verify that scans complete with the expected offline behavior in v4.0.11.

  • breakingFlags --exceptions, --controls-config, --attack-tracks no longer trigger air-gapped mode

    The flags --exceptions, --controls-config, and --attack-tracks no longer trigger air-gapped mode as a side effect. If you use any of these flags, confirm that your scan mode (online or offline) matches your intent in v4.0.11.

  • breakingSeverity-based image exceptions output fix: filtered Matches instead of RemainingMatches

    Severity-based image exceptions in JSON, SARIF, and patch output now use filtered Matches instead of RemainingMatches. If you rely on severity-based image exceptions in these output formats, review the exception behavior in v4.0.11 to confirm alignment with your vulnerability management workflow.

Key changes (9)

  • Air-gapped mode: explicit offline flag threading replaces implicit nil checks
  • Flags --exceptions, --controls-config, --attack-tracks no longer unintentionally trigger air-gapped mode
  • Severity-based image exceptions in JSON, SARIF, patch output now use filtered Matches
  • CEL control execution added with compiled program caching
  • VAP bundle vendored and embedded; deploy-library serves bundle with --from-release option only
  • OPAProcessor headless mode for low-latency Network Policy and RBAC scanning in MCP server
  • Container Image Vulnerability Adaptor interfaces and AWS ECR adaptor implementation
  • PostureExceptionPolicy.ObjectSelector now honors objectSelector.matchExpressions
  • plus ~8 fixes: metrics panic recovery, synchronous scan report population, SARIF writer robustness, local control cache, PersistentPreRun restoration, exceptions/inputs preservation with use-artifacts-from, and output/help improvements
Add Kubescape to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Source ↗All Kubescape releases →