RATATOSKRATATOSK
Sign in

Kubescape

v4.0.20Security
Nov 6, 2026

ACTION 3CHECK 2OTHER 13

A maintenance release focused on correctness, input validation, and protections against denial-of-service conditions. It also enforces restrictions on invalid scan options and tightens handling of scan inputs.

Action needed (3)

  • securityBound and validated report file reads

    The fixhandler now bounds and validates report file reads to prevent denial-of-service conditions.

  • securityBound HTTP response bodies in httpGet

    The resourcehandler now bounds the HTTP response body read by httpGet to prevent denial-of-service conditions.

  • securityBound downloaded CEL policy response bodies

    The vap component now bounds downloaded CEL policy response bodies to prevent denial-of-service conditions.

Check if affected (2)

  • breakingRejected Helm and file-path flags on image scans

    Applies if you run image scans.

    Image scans now reject Helm and file-path flags.

  • breakingRejected namespace and resource kind filter flags on workload scans

    Applies if you run workload scans.

    Workload scans now reject namespace and resource kind filter flags.

All 13 other recorded changesfixes 13

fixes (13)

  • * 8dce41861609da5ebc5b958c49a188b723662e6f fix(cautils): apply positive LARGE_CLUSTER_SIZE fallback to streaming auto-enable check (#4613)
  • * 888c2d706983fe4116e344e931cfcded99d373c6 fix(config): enforce Cobra argument bounds on config set command (#4590)
  • * 637ddfbc31f29923d32a31c3eb1c7898ece76edd fix(diff): prevent diff output from overwriting input reports and validate arguments (#4604)×2
  • * ec65d3184f6bab7d1ad6e5db9d970d452316d253 fix(exceptions): emit ExceptionMatched events only when allowed to (#4616)
  • * 7a62931424f3b8a7e10465ab4a994c3cc95d552b fix(imagescan): preserve source selectors in registry fallback (#4600)
  • * 17448b383778d8a8e580b1faa71272b1c842ae6f fix(policy): treat nil and empty response lists as equal in policy test (#4612)
  • * e6818a0b343e70118795a492d11e12c6bce49d1c fix(rules): match RBAC subresource grants the way the authorizer does (#4610)
  • * beee73eb9bbf80b5fcb048ee39ac950df54d47b8 fix(rules): stop reporting cluster-scoped grants made through RoleBindings (#4611)
  • * 5afb4a1fae16392d3088383d8e2485c466767c50 fix(scan): prepare local inputs and validate stdin for root and security view scans (#4584)
  • * 0b3a1b7bc183b7ba250e85c45a65440ac0fb5295 fix(scan): prevent contract validation from overwriting input (#4596)
  • * 49c9ca86c0d40fb115a09c6c9c642308d0f69a4c fix(scan): reject null entries in contract string lists (#4598)
  • fix(version,update): check nil kubescape interface and empty format validation
Add Kubescape to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Kubescape releases →