Kubescape

v4.0.12Security

2026년 8월 12일

이번 릴리스는 실행 기본값과 네트워크 제약을 조정하고, 사용 중단된 설정을 정리하는 변경을 담았습니다. 의존성 취약점 수정도 포함되어 있어, 해당 설정이나 정책을 사용하는 환경은 업그레이드 전 동작과 구성 검토 대상입니다.

조치 필요 (1)

security의존성 취약점 수정
dependencies 취약점 수정 사항을 일괄 반영했습니다.

영향 확인 (5)

breakingRegoV1 기준 평가와 v0 호환 shim 제거
Rego 정책에 v0 호환 shim을 사용한다면 적용됩니다.
Rego 평가를 RegoV1로 전환하고 v0 호환 shim을 제거했습니다.
breakingpprof 디버그 서버 기본 비활성화
pprof 디버그 서버를 사용한다면 적용됩니다.
pprof 디버그 서버를 opt-in 방식으로 바꿔 기본적으로 실행하지 않습니다.
breaking서비스 네트워크 바인딩의 루프백 제한
영향받는 서비스의 네트워크 바인딩을 설정한다면 적용됩니다.
영향받는 서비스가 루프백 주소에만 바인딩하도록 제한했습니다.
breaking--frameworks 기본값을 all로 변경
--frameworks 플래그를 사용한다면 적용됩니다.
--frameworks 플래그의 기본값을 all로 설정했습니다.
breaking사용 중단된 스캔 플래그 제거
사용 중단된 스캔 플래그를 사용한다면 적용됩니다.
사용 중단된 scan 플래그를 제거하고 문서를 갱신했습니다.

그 외 기록된 변경 220건 전체security fixes 1 · fixes 175 · additions 23 · value changes 13 · constraints 7 · removals 1

security fixes (1)

Security/batch dependency fixes 2

fixes (175)

Guard against unresolvable group/version in resource handler
Propagate printer and command errors
Recover from panics in readJsonFile
[fix] : non-deterministic namespace bucketing caused by mid-scan resource count mutation
[fix] : streaming collector dropping host-sensor fallback, silently passing controls it never evaluated
fix(anonymizer): replace broken type assertions with IWorkload-based container deserialization
fix(cache): publish policy files atomically
fix(cautils): add warning log for invalid useUntilKubescapeVersion semver
fix(cautils): avoid standalone renders of owned Helm dependencies
fix(cautils): clone trailing remote inputs for local-first scans
fix(cautils): expand offline Kubernetes list envelopes
fix(cautils): propagate marshal error in updateConfigFile
fix(cautils): record individual formats in scan metadata
fix(cautils): report the bound port from GetPortForwardLocalhost
fix(cautils): resolve git metadata when scanning from a linked worktree
fix(cautils): return error when worktree root cannot be resolved in NewLocalGitRepository
fix(cautils): return non-NotFound errors from legacy ConfigMap lookup
fix(cautils): sort copies in StringSlicesAreEqual to avoid mutating caller slices
fix(cautils): stop LocalGitRepository exposing a nil-embedded panic to callers
fix(cautils): stop Policies.Set from mutating the caller's frameworks slice
fix(cautils): stop ReportV2ToV1 from mutating the caller's shared resources
fix(cautils): stop conflating insecureSkipTLS with plainHTTP in helm registry client
fix(cautils): synchronize access to global KSCloudAPIConnector to resolve data race
fix(cautils): use filesystem check instead of .json string heuristic in setUseArtifactsFrom
fix(cel): guard optional field paths so valid workloads are evaluated, not skipped
fix(cel): resolve namespaceObject from collected namespaces and honor admission scoping offline
fix(cel): select remediation paths by workload kind
fix(cel): use messageExpression for CEL message bodies, verify bundleControlIDs both ways
fix(cmd): close temporary file handle after streaming stdin in scan commands
fix(config): preserve higher-priority tenant settings
fix(core): add timeout to HTTP client in OperatorAdapter to prevent connection hang
fix(core): align scan attribution with explicit kubeconfig
fix(core): allow operator scan with multiple app=operator pods
fix(core): cancel streaming producer context on early evaluation error
fix(core): correct grammar in download empty-response errors
fix(core): correct unknown command error message in List()
fix(core): detect multipart SBOM output collisions
fix(core): download --output bare .json path no longer falls back to ~/.kubescape
fix(core): escape inner quotes in FixPathToValidYamlExpression string values
fix(core): expand ScanAll frameworks before resolving cache paths
fix(core): ignore unusable image pull secret credentials
fix(core): limit ScanAll expansion to framework scans and dedupe UseFrom
fix(core): log swallowed errors when loading cached/cluster config
fix(core): make ProgressHandler.Stop() complete the progress bar
fix(core): parse digest-pinned image references correctly for exceptions
fix(core): preserve non-zero risk score rounding in HTML report
fix(core): prevent sub-100 compliance scores formatting as 100.00
fix(core): recurse convertYamlToJson into map[string]any values
fix(core): remove racy re-check of global cluster connection state
fix(core): reset HostSensorEnabled when explicit host scanner fails to init
fix(core): return cluster connection failures from Scan instead of terminating
fix(core): return error when io.ReadAll fails in NewFixHandler
fix(core): shut down the exception event broadcaster after each scan
fix(core): skip image scanner initialization when no images
fix(core): stop nilling global os.Stdout/os.Stderr during copa patch
fix(core): stop port-forward when startup fails to avoid goroutine leak (#2835)
fix(core): treat closed/non-interactive stdin as refusal in userConfirmed to prevent CPU spin (#2712)
fix(core): use restrictive permissions for created output directories (#2648)
fix(core): wire --address flag into buildkit client options for patch (#2735)
fix(coverage): sort partial GVR pull diagnostics (#2934)
fix(csv): guarantee a flush attempt on every ActionPrint exit path (#2981)
fix(diff): reject invalid scan reports (#2877)
fix(diff): sort ChangeSet buckets so diff output is reproducible (#2734)
fix(downloader): add 10-minute timeout to background context to prevent hangs (#3014)
fix(downloader): add bounded retry with backoff for artifact downloads (#3016)
fix(downloader): aggregate errors in download loop to catch swallowed failures (#3011)
fix(downloader): exit non-zero on download failures (#2969)
fix(fixhandler): guard nil resource lookup and off-by-one slice bound (#2597)
fix(fixhandler): preserve accepted base path spelling (#2678)
fix(fixhandler): prevent path traversal when resolving resource paths (#2637)
fix(fixhandler): quote NaN and Inf fix values so yq expressions parse (#2714)
fix(fixhandler): skip document node when resolving a line to replace (#2896)
fix(git): make remote workspaces concurrency safe (#2548)
fix(git): support detached HEAD repository metadata (#2567)
fix(hostsensor): avoid mutating shared Kubernetes config (#2938)
fix(hostsensor): key cache by cluster identity and gate it behind opt-in TTL (#2914)
fix(http): bound scan admission and request bodies (#2547)
fix(httphandler): advertise Allow: GET on Metrics 405 response (#2647)
fix(httphandler): harden metrics query handling (#2635)
fix(httphandler): preserve non-JSON HTTP scan results (#2936)
fix(httphandler): retain scan ID in synchronous responses (#2931)
fix(httphandler): stop sending wrong HTTP status from Status handler (#2649)
fix(imagescan): close the previous gRPC client on repeated GCP Login calls (#2982)
fix(imagescan): prevent gRPC connection leak in GCP adaptor (#2954)
fix(imagescan): properly reject unsupported token credentials in cloud adaptors (#2943)
fix(imagescan): scope pull secrets to cluster scans (#2964)
fix(imagescan): standardize partial-failure handling across cloud adaptors (#2941)
fix(imagescan): support enhanced ECR scan findings (#2966)
fix(junit): report compliance scores in test suites (#2565)
fix(listener): fail fast when server port is busy (#2636)
fix(locationresolver): add context to yaml evaluation errors (#2615)
fix(locationresolver): guard nil candidateNodes.Back() (#2583)
fix(locationresolver): split fix paths on the first '=' rather than the last (#2850)
fix(mcp): graceful error handling for legacy MCP tools (#2748)
fix(mcpserver): handle malformed tool arguments safely (#2566)
fix(mcpserver): reject empty resource URI segments (#2616)
fix(mcpserver): retry client init instead of caching first error (#2629)
fix(opaprocessor): keep resource snapshot stable during rules (#2667)
fix(opaprocessor): register OPA builtins once per process, not once per scan (#2624)
fix(opaprocessor): resolve namespaceObject for CEL admission evaluation (#2603)
fix(opaprocessor): scrub stringData field in Secret resources (#2757)
make GetRequestPayload side-effect-free
fix(operator): propagate --namespace flag to scan subcommands- #2 (#2591)
fix(operator): resolve cluster name after context selection (#2939)
fix(operator): scope examples to the scan subcommand (#2915)
fix(output): drop truncated image label from scan hints (#2568)
fix(patch): surface package install failures instead of exporting an empty image (#2574)
fix(paths): anchor reported paths to the git root when git metadata is unusable (#2600)
fix(policyhandler): bound registry growth with idle eviction (#2909)
fix(policyhandler): reset the PolicyHandler singleton when clusterName changes (#2742)
fix(prerequisites): exit non-zero when cluster data collection fails (#2997)
fix(printer): avoid perfect score rounding (#2665)
fix(printer): handle GetContainers errors when resolving container names (#2539)
fix(printer): keep PDF footnote markers consistent between table and legend (#3004)
fix(printer): keep yaml compliance score below perfect (#2726)
fix(printer): label the report with the context the scan actually used (#2898)
fix(printer): parse SARIF doc index on the last colon, not the second field (#2685)
fix(printer): prevent nil-pointer panics and report truncation when resources are missing (#2700)
fix(printer): prevent silent data loss on CSV write errors (#2959)
fix(printer): separate name and version in package score map key (#2692)
fix(printer): write leading newline to the configured output writer (#2595)
fix(prometheus): group metric samples by family in the exposition output (#3021)
fix(prometheus): report compliance scores in gauges (#2580)
fix(reportcrypto): stop rewriting plaintext values during decryption (#2998)
fix(resourcehandler): check HTTP status code in httpGet (dead-code hardening) (#2674)
fix(resourcehandler): classify missing LIST resources using typed Kubernetes errors (#2903)
fix(resourcehandler): count returned items in cluster size estimate (#2886)
fix(resourcehandler): discover nested Kustomize directories in broad scans (#2888)
fix(resourcehandler): honor discovered scope when streaming resources (#2821)
fix(resourcehandler): let Kustomize own referenced Helm charts (#2855)
fix(resourcehandler): log warnings on directory discovery errors in LoadResourcesFromNestedKustomizeDirectories (#2906)
fix(resourcehandler): propagate file stream cancellation (#2935)
fix(resourcehandler): propagate streaming LIST failures (#2771)
fix(resourcehandler): render nested Kustomize configurations (#2860)
fix(resourcehandler): repair NewOPASessionObj call broken by merge (#2783)
fix(resourcehandler): resolve offline resources from manifests (#2752)
fix(resourcehandler): scan Agent Sandbox and Substrate CRDs consistently (#2618)
fix(results): preserve enrichment in programmatic and HTTP output (#2862)
fix(resultshandling): handle unscored score sentinel in summary table compliance column (#2791)
fix(resultshandling): make finalized report ordering deterministic (#2773)
fix(sarif): avoid image output stdout deadlock (#2967)
fix(sarif): guard delta walk against out-of-range line and segment indexes (#2865)
fix(sarif): render and patch image scan SARIF in memory instead of reopening the writer (#2984)
fix(sarif): use rune count for multi-byte line length in fix regions (#2552)
fix(scan): accept local inputs for workload scans (#2746)
fix(scan): dynamically build supported formats error message (#2870)
fix(scan): enforce image thresholds in explicit subcommands (#2929)
fix(scan): honor only-fixable in combined image scans (#2928)
fix(scan): return errors instead of using logger.Fatal (#2857)
fix(scan): surface manifest loading failures (#2546)
fix(scan): validate threshold ranges in scan control command (#2916)
fix(shared): prioritize auth conflict error over missing password (#3042)
fix(storage): propagate workload scan update errors (#2937)
fix(streaming): initialize cluster metadata before policy planning (#2956)
fix(streaming): restore host-sensor InfoMap and namespace resource counting in streaming collector (#2808) (#2809)
fix(tableprinter): truncate control/resource names on a rune boundary (#2676)
fix(vap): bound deploy-library downloads with a default timeout (#3001)
fix: add epsilon tolerance to Float32ToIntFloor for float32 precision loss (#2669)
fix: change break to continue in helm workloads loader (#2605)
fix: count returned items in cluster-size estimates (#2847)
fix: don't crash or auto-submit when no backend is configured (#2556)
fix: enforce image severity threshold on combined scans (#2894)
fix: include initContainers and ephemeralContainers in image scan (#2979) (#2980)
fix: mark CRD-only controls not evaluated after partial discovery failure (#2839)
fix: populate ClusterName in JSON reports (#2866)
fix: register deprecated flags to prevent unknown flag errors (#2868)
fix: replace control merge loops with assignment to clear stale controls (#3049) (#3051)
fix: resolve CRD exception deduplication dropping non-overlapping policies (#2805)
fix: resolve HTTPPost connection leak on error by draining response body (#2807)
fix: resolve data race in display spinner (#2975) (#2978)
fix: resolve review feedback for CycloneDX/SPDX SBOM output formats (#2883)
fix: return error when control inputs are nil or empty (#2601)
fix: return values for IKubescape List and Download (#2794)
wrap DEK error, enforce image severity thresholds, and refactor error formats (#2902)
enforce image severity thresholds

additions (23)

Support scoped registry auth for image scans
feat : add DELETE /v1/scan to cancel an in-flight scan
feat(core): implement concurrent and deduplicated image scan pipeline (KS-ADV-02)
feat(imagescan): support scanning local offline tarball images
feat(mcp): add headless framework security scanner tool
feat(mcp): add local IaC scanner tool
feat(mcpserver): add scan_container_image tool for on-demand vulnerability scanning (KS-INT-03)
feat(printer): add markdown output format
feat(resourcesprioritization): support configurable workload kinds and dynamic pod template spec detection
feat(scan): add --api-version flag to workload scan command
feat(scan): add --label-selector flag to filter collected resources
feat(streaming): Add resource streaming for large clusters to reduce memory usage
feat(version): add --output json flag
feat: Automated In-Cluster Private Registry Credential Resolver
feat: add --only-fixable flag to gate scan image severity threshold on fix availability
feat: add CSV output format printer for scan results
feat: add YAML output format to kubescape list
feat: add configurable config view output formats
feat: add csv output for list command
feat: implement Runtime Profile Drift Detection and Remediation (KS-ADV-01)
feat: introduce Container Image Vulnerability (CIV) Adaptor for Azure Container Registry
feat: introduce native GCP Artifact Registry vulnerability adaptor (Phase 2)
feat: support yaml as an output format

value changes (13)

Unify scan stdin input handling
anonymizer: pin and document the intentional cross-prefix hash-suffix sharing (was: hash prefix+value)
feat(csv): add remediation path evidence columns to CSV scan output
feat(exceptions): prefer cloud exceptions over CRD
feat(hostsensor): optimize query with paging, rate limits, and cache
feat(html): show current field values in evidence paths
feat(printer): surface current field value alongside failed paths in scan output
feat: give CEL findings the remediation paths their Rego equivalents carry
feat: spend one CEL cost budget per policy the way admission does
perf(opaprocessor): index a scope's resources once instead of per rule (#2976)
perf(sarif): cache per-file work when collecting fixes and locations (#2921)
refactor(policyhandler): make PolicyHandler stateless per request to eliminate scanMu blocking (#2899)
refactor(resourcehandler): use canonical path containment for kustomize exclusion (#2907)

constraints (7)

feat(patch): support all image scan output formats
feat(scan): support parsing apiVersion in workload identifier
feat: add Azure AKS support to ListEntitiesForPolicies resource mapping
feat: add fallback support for OpenShift external registry routes
feat: scan kubernetes_manifest resources in Terraform files
feat: scan typed kubernetes_* resources in Terraform files
feat: support all output formats for image scans

removals (1)

fix(cautils): remove dead nil-check in setHeaders

Kubescape 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →

공식 릴리스 노트 ↗Kubescape 릴리스 전체 →