A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.
Action needed (7)
securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated
golang.andorg/x/crypto x/netdependenciesThe
golang.dependency was updated to v0.53.0 andorg/x/crypto x/netto v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
security
cel-gov0.30.0cel-gowas updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.
Check if affected (6)
breakingRequired
--resourcefor the migrate commandApplies when the migrate command runs.
breakingDefault
userInfogroups and UID during background scansApplies when background scans run.
breaking
excludeBootstrapResourceswebhook flagApplies when you configure Fail webhooks.
- + 3 more on the release page
Plan ahead (1)
deprecatedDeprecation notices for legacy
kyverno.policy typesio Applies when you use legacy
kyverno.policy types.io