RATATOSKRATATOSK
Sign in

Kyverno

v1.19.1Security
Sep 10, 2026

ACTION 2CHECK 3OTHER 22

A security-focused maintenance release with dependency updates and fixes for policy and egress behavior. It also includes correctness changes, deprecation warning enforcement, and a narrowed policy constraint that may require operator changes.

Action needed (2)

Check if affected (3)

  • securityPolicyException scope bypass fix for GHSA-5cjf-wwfg-pj4c

    Applies if you use the PolicyException CRD.

    The release fixes the PolicyException scope bypass identified by GHSA-5cjf-wwfg-pj4c.

    kyverno#17307

  • securityapiCall.service egress blocklist bypass fix

    Applies if you configure apiCall.service egress.

    The release closes the IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress.

    kyverno#17329

  • breakingglobalContext constraint in namespaced policies

    Applies if you use globalContext in namespaced policies.

    The release denies globalContext in namespaced policies.

    kyverno#17455

All 22 other recorded changesfixes 17 · additions 2 · value changes 2 · constraints 1

fixes (17)

  • * Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #17262) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17273
  • * fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #17234) by @realshuting in https://github.com/kyverno/kyverno/pull/17298
  • * fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick #17299) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17302
  • * fix: avoid data race in image evaluator prefetch (Cherry-pick #17313) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17327
  • * fix: backport 7ac176ac apiCall urlPath hardening to release-1.19 by @realshuting in https://github.com/kyverno/kyverno/pull/17361
  • * fix: validate PolicyException CEL match conditions (Cherry-pick #17350) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17373
  • * fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pick #17136) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17430
  • * fix: handle missing reports CRDs as no-op in kyverno-init (Cherry-pick #17420) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17435
  • * fix: skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pick #17140) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17437
  • * fix(gpol): propagate synchronize option to UpdateRequests (Cherry-pick #16920) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17446
  • * fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling (Cherry-pick #16904) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17454
  • * fix(webhook): avoid redundant recorder notifications (Cherry-pick #17059) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17451
  • * fix(reports): fix label prefix and metadata for namespaced CEL policies (Cherry-pick #17460) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17480
  • * fix: close layer readers per-iteration to avoid FD/memory leak (Cherry-pick #16994) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17498
  • * fix(gpol): recreate downstream resource after repeated deletions (Cherry-pick #17453) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17520
  • * fix: skip scalar values during wildcard image extraction (Cherry-pick #16268) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17521
  • * fix(reports): discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pick #17395) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17447

additions (2)

  • * feat: phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pick #17362) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17378
  • * feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pick #17428) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17434

value changes (2)

  • * fix(deps): bump golang.org/x/mod to v0.40.0 by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17358
  • * [release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2 by @realshuting in https://github.com/kyverno/kyverno/pull/17513

constraints (1)

  • * feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pick #17014) by @Rohanraj123 in https://github.com/kyverno/kyverno/pull/17530
Add Kyverno to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Kyverno releases →