Kubescape

v4.0.12Security

2026年8月12日

ACTION 1CHECK 5OTHER 220

v4.0.12は、既定値やネットワーク制約、互換性に関わる設定を見直した修正中心のリリースです。利用しているデバッグ機能やフラグによっては、アップグレード前に設定の確認が必要です。依存関係の脆弱性修正も含まれています。

要対応 (1)

security依存関係の脆弱性修正
dependencies に含まれる脆弱性をまとめて修正しました。対象は Batch 1 と Batch 2 です。

影響確認 (5)

breakingv0 互換シムの削除
v0 互換シムを使うRegoポリシーを利用している場合に適用されます。
Regoの評価を RegoV1 に切り替え、v0 互換シムを削除しました。
breakingpprof デバッグサーバーのオプトイン化
pprof デバッグサーバーを利用している場合に適用されます。
pprof デバッグサーバーは、明示的に有効化した場合だけ起動する設定になりました。
breakingネットワークバインドのループバック限定
対象サービスのネットワークバインドを設定している場合に適用されます。
対象サービスのネットワークバインドがループバックのみになる制約を追加しました。変更は #2639 に関連します。
breaking--frameworks の既定値変更
--frameworks フラグを利用している場合に適用されます。
--frameworks フラグの既定値を all に変更しました。
breaking非推奨スキャンフラグの削除
非推奨のスキャンフラグを利用している場合に適用されます。
非推奨のスキャンフラグを削除し、ドキュメントも更新しました。変更は #2608 に関連します。

その他の記録済み変更 220 件すべてsecurity fixes 1 · fixes 175 · additions 23 · value changes 13 · constraints 7 · removals 1

security fixes (1)

Security/batch dependency fixes 2

fixes (175)

Guard against unresolvable group/version in resource handler
Propagate printer and command errors
Recover from panics in readJsonFile
[fix] : non-deterministic namespace bucketing caused by mid-scan resource count mutation
[fix] : streaming collector dropping host-sensor fallback, silently passing controls it never evaluated
fix(anonymizer): replace broken type assertions with IWorkload-based container deserialization
fix(cache): publish policy files atomically
fix(cautils): add warning log for invalid useUntilKubescapeVersion semver
fix(cautils): avoid standalone renders of owned Helm dependencies
fix(cautils): clone trailing remote inputs for local-first scans
fix(cautils): expand offline Kubernetes list envelopes
fix(cautils): propagate marshal error in updateConfigFile
fix(cautils): record individual formats in scan metadata
fix(cautils): report the bound port from GetPortForwardLocalhost
fix(cautils): resolve git metadata when scanning from a linked worktree
fix(cautils): return error when worktree root cannot be resolved in NewLocalGitRepository
fix(cautils): return non-NotFound errors from legacy ConfigMap lookup
fix(cautils): sort copies in StringSlicesAreEqual to avoid mutating caller slices
fix(cautils): stop LocalGitRepository exposing a nil-embedded panic to callers
fix(cautils): stop Policies.Set from mutating the caller's frameworks slice
fix(cautils): stop ReportV2ToV1 from mutating the caller's shared resources
fix(cautils): stop conflating insecureSkipTLS with plainHTTP in helm registry client
fix(cautils): synchronize access to global KSCloudAPIConnector to resolve data race
fix(cautils): use filesystem check instead of .json string heuristic in setUseArtifactsFrom
fix(cel): guard optional field paths so valid workloads are evaluated, not skipped
fix(cel): resolve namespaceObject from collected namespaces and honor admission scoping offline
fix(cel): select remediation paths by workload kind
fix(cel): use messageExpression for CEL message bodies, verify bundleControlIDs both ways
fix(cmd): close temporary file handle after streaming stdin in scan commands
fix(config): preserve higher-priority tenant settings
fix(core): add timeout to HTTP client in OperatorAdapter to prevent connection hang
fix(core): align scan attribution with explicit kubeconfig
fix(core): allow operator scan with multiple app=operator pods
fix(core): cancel streaming producer context on early evaluation error
fix(core): correct grammar in download empty-response errors
fix(core): correct unknown command error message in List()
fix(core): detect multipart SBOM output collisions
fix(core): download --output bare .json path no longer falls back to ~/.kubescape
fix(core): escape inner quotes in FixPathToValidYamlExpression string values
fix(core): expand ScanAll frameworks before resolving cache paths
fix(core): ignore unusable image pull secret credentials
fix(core): limit ScanAll expansion to framework scans and dedupe UseFrom
fix(core): log swallowed errors when loading cached/cluster config
fix(core): make ProgressHandler.Stop() complete the progress bar
fix(core): parse digest-pinned image references correctly for exceptions
fix(core): preserve non-zero risk score rounding in HTML report
fix(core): prevent sub-100 compliance scores formatting as 100.00
fix(core): recurse convertYamlToJson into map[string]any values
fix(core): remove racy re-check of global cluster connection state
fix(core): reset HostSensorEnabled when explicit host scanner fails to init
fix(core): return cluster connection failures from Scan instead of terminating
fix(core): return error when io.ReadAll fails in NewFixHandler
fix(core): shut down the exception event broadcaster after each scan
fix(core): skip image scanner initialization when no images
fix(core): stop nilling global os.Stdout/os.Stderr during copa patch
fix(core): stop port-forward when startup fails to avoid goroutine leak (#2835)
fix(core): treat closed/non-interactive stdin as refusal in userConfirmed to prevent CPU spin (#2712)
fix(core): use restrictive permissions for created output directories (#2648)
fix(core): wire --address flag into buildkit client options for patch (#2735)
fix(coverage): sort partial GVR pull diagnostics (#2934)
fix(csv): guarantee a flush attempt on every ActionPrint exit path (#2981)
fix(diff): reject invalid scan reports (#2877)
fix(diff): sort ChangeSet buckets so diff output is reproducible (#2734)
fix(downloader): add 10-minute timeout to background context to prevent hangs (#3014)
fix(downloader): add bounded retry with backoff for artifact downloads (#3016)
fix(downloader): aggregate errors in download loop to catch swallowed failures (#3011)
fix(downloader): exit non-zero on download failures (#2969)
fix(fixhandler): guard nil resource lookup and off-by-one slice bound (#2597)
fix(fixhandler): preserve accepted base path spelling (#2678)
fix(fixhandler): prevent path traversal when resolving resource paths (#2637)
fix(fixhandler): quote NaN and Inf fix values so yq expressions parse (#2714)
fix(fixhandler): skip document node when resolving a line to replace (#2896)
fix(git): make remote workspaces concurrency safe (#2548)
fix(git): support detached HEAD repository metadata (#2567)
fix(hostsensor): avoid mutating shared Kubernetes config (#2938)
fix(hostsensor): key cache by cluster identity and gate it behind opt-in TTL (#2914)
fix(http): bound scan admission and request bodies (#2547)
fix(httphandler): advertise Allow: GET on Metrics 405 response (#2647)
fix(httphandler): harden metrics query handling (#2635)
fix(httphandler): preserve non-JSON HTTP scan results (#2936)
fix(httphandler): retain scan ID in synchronous responses (#2931)
fix(httphandler): stop sending wrong HTTP status from Status handler (#2649)
fix(imagescan): close the previous gRPC client on repeated GCP Login calls (#2982)
fix(imagescan): prevent gRPC connection leak in GCP adaptor (#2954)
fix(imagescan): properly reject unsupported token credentials in cloud adaptors (#2943)
fix(imagescan): scope pull secrets to cluster scans (#2964)
fix(imagescan): standardize partial-failure handling across cloud adaptors (#2941)
fix(imagescan): support enhanced ECR scan findings (#2966)
fix(junit): report compliance scores in test suites (#2565)
fix(listener): fail fast when server port is busy (#2636)
fix(locationresolver): add context to yaml evaluation errors (#2615)
fix(locationresolver): guard nil candidateNodes.Back() (#2583)
fix(locationresolver): split fix paths on the first '=' rather than the last (#2850)
fix(mcp): graceful error handling for legacy MCP tools (#2748)
fix(mcpserver): handle malformed tool arguments safely (#2566)
fix(mcpserver): reject empty resource URI segments (#2616)
fix(mcpserver): retry client init instead of caching first error (#2629)
fix(opaprocessor): keep resource snapshot stable during rules (#2667)
fix(opaprocessor): register OPA builtins once per process, not once per scan (#2624)
fix(opaprocessor): resolve namespaceObject for CEL admission evaluation (#2603)
fix(opaprocessor): scrub stringData field in Secret resources (#2757)
make GetRequestPayload side-effect-free
fix(operator): propagate --namespace flag to scan subcommands- #2 (#2591)
fix(operator): resolve cluster name after context selection (#2939)
fix(operator): scope examples to the scan subcommand (#2915)
fix(output): drop truncated image label from scan hints (#2568)
fix(patch): surface package install failures instead of exporting an empty image (#2574)
fix(paths): anchor reported paths to the git root when git metadata is unusable (#2600)
fix(policyhandler): bound registry growth with idle eviction (#2909)
fix(policyhandler): reset the PolicyHandler singleton when clusterName changes (#2742)
fix(prerequisites): exit non-zero when cluster data collection fails (#2997)
fix(printer): avoid perfect score rounding (#2665)
fix(printer): handle GetContainers errors when resolving container names (#2539)
fix(printer): keep PDF footnote markers consistent between table and legend (#3004)
fix(printer): keep yaml compliance score below perfect (#2726)
fix(printer): label the report with the context the scan actually used (#2898)
fix(printer): parse SARIF doc index on the last colon, not the second field (#2685)
fix(printer): prevent nil-pointer panics and report truncation when resources are missing (#2700)
fix(printer): prevent silent data loss on CSV write errors (#2959)
fix(printer): separate name and version in package score map key (#2692)
fix(printer): write leading newline to the configured output writer (#2595)
fix(prometheus): group metric samples by family in the exposition output (#3021)
fix(prometheus): report compliance scores in gauges (#2580)
fix(reportcrypto): stop rewriting plaintext values during decryption (#2998)
fix(resourcehandler): check HTTP status code in httpGet (dead-code hardening) (#2674)
fix(resourcehandler): classify missing LIST resources using typed Kubernetes errors (#2903)
fix(resourcehandler): count returned items in cluster size estimate (#2886)
fix(resourcehandler): discover nested Kustomize directories in broad scans (#2888)
fix(resourcehandler): honor discovered scope when streaming resources (#2821)
fix(resourcehandler): let Kustomize own referenced Helm charts (#2855)
fix(resourcehandler): log warnings on directory discovery errors in LoadResourcesFromNestedKustomizeDirectories (#2906)
fix(resourcehandler): propagate file stream cancellation (#2935)
fix(resourcehandler): propagate streaming LIST failures (#2771)
fix(resourcehandler): render nested Kustomize configurations (#2860)
fix(resourcehandler): repair NewOPASessionObj call broken by merge (#2783)
fix(resourcehandler): resolve offline resources from manifests (#2752)
fix(resourcehandler): scan Agent Sandbox and Substrate CRDs consistently (#2618)
fix(results): preserve enrichment in programmatic and HTTP output (#2862)
fix(resultshandling): handle unscored score sentinel in summary table compliance column (#2791)
fix(resultshandling): make finalized report ordering deterministic (#2773)
fix(sarif): avoid image output stdout deadlock (#2967)
fix(sarif): guard delta walk against out-of-range line and segment indexes (#2865)
fix(sarif): render and patch image scan SARIF in memory instead of reopening the writer (#2984)
fix(sarif): use rune count for multi-byte line length in fix regions (#2552)
fix(scan): accept local inputs for workload scans (#2746)
fix(scan): dynamically build supported formats error message (#2870)
fix(scan): enforce image thresholds in explicit subcommands (#2929)
fix(scan): honor only-fixable in combined image scans (#2928)
fix(scan): return errors instead of using logger.Fatal (#2857)
fix(scan): surface manifest loading failures (#2546)
fix(scan): validate threshold ranges in scan control command (#2916)
fix(shared): prioritize auth conflict error over missing password (#3042)
fix(storage): propagate workload scan update errors (#2937)
fix(streaming): initialize cluster metadata before policy planning (#2956)
fix(streaming): restore host-sensor InfoMap and namespace resource counting in streaming collector (#2808) (#2809)
fix(tableprinter): truncate control/resource names on a rune boundary (#2676)
fix(vap): bound deploy-library downloads with a default timeout (#3001)
fix: add epsilon tolerance to Float32ToIntFloor for float32 precision loss (#2669)
fix: change break to continue in helm workloads loader (#2605)
fix: count returned items in cluster-size estimates (#2847)
fix: don't crash or auto-submit when no backend is configured (#2556)
fix: enforce image severity threshold on combined scans (#2894)
fix: include initContainers and ephemeralContainers in image scan (#2979) (#2980)
fix: mark CRD-only controls not evaluated after partial discovery failure (#2839)
fix: populate ClusterName in JSON reports (#2866)
fix: register deprecated flags to prevent unknown flag errors (#2868)
fix: replace control merge loops with assignment to clear stale controls (#3049) (#3051)
fix: resolve CRD exception deduplication dropping non-overlapping policies (#2805)
fix: resolve HTTPPost connection leak on error by draining response body (#2807)
fix: resolve data race in display spinner (#2975) (#2978)
fix: resolve review feedback for CycloneDX/SPDX SBOM output formats (#2883)
fix: return error when control inputs are nil or empty (#2601)
fix: return values for IKubescape List and Download (#2794)
wrap DEK error, enforce image severity thresholds, and refactor error formats (#2902)
enforce image severity thresholds

additions (23)

Support scoped registry auth for image scans
feat : add DELETE /v1/scan to cancel an in-flight scan
feat(core): implement concurrent and deduplicated image scan pipeline (KS-ADV-02)
feat(imagescan): support scanning local offline tarball images
feat(mcp): add headless framework security scanner tool
feat(mcp): add local IaC scanner tool
feat(mcpserver): add scan_container_image tool for on-demand vulnerability scanning (KS-INT-03)
feat(printer): add markdown output format
feat(resourcesprioritization): support configurable workload kinds and dynamic pod template spec detection
feat(scan): add --api-version flag to workload scan command
feat(scan): add --label-selector flag to filter collected resources
feat(streaming): Add resource streaming for large clusters to reduce memory usage
feat(version): add --output json flag
feat: Automated In-Cluster Private Registry Credential Resolver
feat: add --only-fixable flag to gate scan image severity threshold on fix availability
feat: add CSV output format printer for scan results
feat: add YAML output format to kubescape list
feat: add configurable config view output formats
feat: add csv output for list command
feat: implement Runtime Profile Drift Detection and Remediation (KS-ADV-01)
feat: introduce Container Image Vulnerability (CIV) Adaptor for Azure Container Registry
feat: introduce native GCP Artifact Registry vulnerability adaptor (Phase 2)
feat: support yaml as an output format

value changes (13)

Unify scan stdin input handling
anonymizer: pin and document the intentional cross-prefix hash-suffix sharing (was: hash prefix+value)
feat(csv): add remediation path evidence columns to CSV scan output
feat(exceptions): prefer cloud exceptions over CRD
feat(hostsensor): optimize query with paging, rate limits, and cache
feat(html): show current field values in evidence paths
feat(printer): surface current field value alongside failed paths in scan output
feat: give CEL findings the remediation paths their Rego equivalents carry
feat: spend one CEL cost budget per policy the way admission does
perf(opaprocessor): index a scope's resources once instead of per rule (#2976)
perf(sarif): cache per-file work when collecting fixes and locations (#2921)
refactor(policyhandler): make PolicyHandler stateless per request to eliminate scanMu blocking (#2899)
refactor(resourcehandler): use canonical path containment for kustomize exclusion (#2907)

constraints (7)

feat(patch): support all image scan output formats
feat(scan): support parsing apiVersion in workload identifier
feat: add Azure AKS support to ListEntitiesForPolicies resource mapping
feat: add fallback support for OpenShift external registry routes
feat: scan kubernetes_manifest resources in Terraform files
feat: scan typed kubernetes_* resources in Terraform files
feat: support all output formats for image scans

removals (1)

fix(cautils): remove dead nil-check in setHeaders

Kubescapeをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →

公式リリースノート ↗Kubescapeのリリース一覧 →