RATATOSKRATATOSK
로그인

Kubescape

v4.0.16Security
2026년 10월 14일

OTHER 94

새로운 스캔, 보고, MCP, 조치 기능을 더한 기능 및 유지보수 릴리스입니다. 정확성 수정, 의존성 업데이트, 성능 개선도 함께 포함됩니다.

그 외 기록된 변경 94건 전체fixes 56 · value changes 21 · additions 15 · constraints 2

fixes (56)

  • * 4a3ccb4b79ea6b2b6d19c7fc488333cc8d9e4939 Honor control exclusions in HTTP scans (#4116)
  • * 6b8f6cf74d9f792aacc020184b2ef0b69f9a599e fix(baseline): handle CloseWriter error on success path in writeBaselineHeadReport (#4006)
  • * c012bad21dd7b0305cece9a72d0b39c5b534850c fix(cel): collect Namespace context beyond workload filters (#4062)
  • * 01ce227b89781771dcea22042a573c4747f80aad fix(core): respect context cancellation in credential retry loop (#3998)
  • * 1b919102ab36e3c885a3547672177116d1ad320b fix(core): reuse initialized Kubernetes client across scan interfaces (#3979)
  • * 9c4acdd33a73fef03094e81fbddf02de3972b529 fix(csv): include delete paths in the failed paths column (#4086)
  • * fe9d1b0c73b1ed067da2b879fc3e0a76556451f7 fix(download): include security view frameworks in download artifacts (#4119)
  • * c612b89456e468fe722e33c098596f88daf24769 fix(exposure): honor Gateway listener hostname intersection (#4089)
  • * 61860a750c843b06bb5d4488ef23c6e4f21d99fa fix(exposure): honor Gateway parent listener ports (#4102)
  • * 47c6c5fc060d7631e3f995a172f9c9380b6671e7 fix(exposure): ignore zero-weight Gateway backends (#4101)
  • * beeb55388384ce7818321d3ffec341e2a7b64f28 fix(exposure): resolve HTTP backend Service ports (#4151)
  • * 4a5e351ba85ad8cd0bb7a60dad6050e8be1b0859 fix(exposure): respect Gateway listener protocol compatibility (#4120)
  • * f476ba02707e84a73cd72c1b77416750cda546e3 fix(fix): fix multi-input scans outside git and recreate their tree under --output-dir (#4054)
  • * 5ce94758f19e7fb21d916cf2ee4d87542410ffb2 fix(fleet): report a cluster as unreachable only when it never answered (#4022)
  • * 388a234b5d18421689be4ad704336d8e70dd8b60 fix(httphandler): cancel scan on client disconnect in /v1/metrics (#4039)
  • * d90f77314c7d4f2b53cf2425844bde2315bd26d2 fix(httphandler): create scan result files with 0600 and redact paths from scan errors (#4016)
  • * 1bba0ba61452f0c0fac68c7b09b1e5870a293cc2 fix(httphandler): dynamically reload TLS key pair on file update (#4105)
  • * d6914cebc2c44ff363620c85d7b30f6f40d1f4f3 fix(httphandler): read metrics results from the prometheus .txt path (#3981)
  • * 0307d8fdf74001685c5c0546a4227e0044475396 fix(image): fail loudly on --exceptions with non-registry inputs (#3824)
  • * dbcf548befd6eed5c59aeea22954e3ad0cb60a65 fix(imagescan): apply exponential backoff on Quay HTTP 429 when Retry-After is omitted (#3996)
  • * 805f9ec1951280a72e07ce383539e4a891e3e40e fix(imagescan): guard Harbor and GitLab redirect origins (#4147)
  • * a3959bb21d102a3284ce2d3dbca58bc3a9c759e9 fix(imagescan): inspect complete GCP scan status (#4051)
  • * c63a89899f065a538aae43b919d371bfc52f7ecc fix(imagescan): keep Quay credentials within their registry origin (#4134)
  • * 7123217d0aa559348fc9fe5be13b4d2d262c501c fix(imagescan): keep latest Harbor scan status (#4052)
  • * 726ed5ca6d34f162f8deb3a157ceb8e2b0ca93c5 fix(imagescan): match GitLab findings to exact image identity (#4122)
  • * b6582714d57e9f3663bc22d03e7b8eada3f3dbed fix(imagescan): normalize RHSA severity labels in Quay adaptor (#4035)
  • * c3a833bae2deeef14c8c523d500971f77290c4cd fix(imagescan): preserve Quay redirect trust across callbacks (#4150)
  • * 21957352dd8c08c81d9717aab3e637fb96e114ef fix(imagescan): query ECR scans in the image registry region (#4132)
  • * 99621ce00d2851ef8618e823bddd62e462988aac fix(imagescan): query the ECR image owner account (#4090)
  • * 1a12f874b9307e18e3fc40b614f4dd07fc4f1a2a fix(imagescan): record resolved manifest digest into ImageID.Hash for Quay scans (#3994)
  • * 2d6c5c3f75a4096fea48b069965f96c81e7b0143 fix(imagescan): resolve GitLab registry project boundaries (#4121)
  • * 17e6da0f1493193725b5827157d9b73557316073 fix(imagescan): retain GCP findings on discovery errors (#4149)
  • * d79180b054945c3cfef414e95435d75111e8f4a7 fix(imagescan): select newest Azure scan assessment (#4152)
  • * 0d76fed40fc51cd554dac1ab52b850bc517fb33e fix(imagescan): validate Harbor image registry ownership (#4148)
  • * ea636627883d0f25b8791f43f108238b4ab4161b fix(install): handle null user PATH and add non-interactive flags in install.ps1 (#4065)
  • * 640d826238337a90b6d9ae283a42456f52cbf93d fix(kustomize): report Kustomize sources relative to the repo root (#3954)
  • * 4b4af2fe8e99c39392b3a79da1341a31fef20528 fix(mcpserver): harden argument validation and bounds for advanced tools (#4075)
  • * 59a11c2737de40d31d15d5ce4747d192c8897fb3 fix(mcpserver): harmonize tool argument validation with structured errors (#4100)
  • * 8ba0d9cf5660fde49df0fc4ce64cb5e92ff5cfe7 fix(mcpserver): reject cross-origin requests to the SSE transport (#4032)
  • * 2c8b4a4f935d7114b74fc592c866f933213c5da7 fix(mcpserver): serve MCP initialize before the policy bundle loads (#4144)
  • * bb4ebe145667f51c2142b0ac6e0102bf7dfbc847 fix(networkpolicy): evaluate ipBlock peers against every IP of a dual-stack pod (#4140)
  • * 15346b873436f055e64df7d82d7ecb31f19e2f10 fix(networkpolicy): report hostNetwork pods as unknown instead of isolated (#4060)
  • * 12526c858ced510a1f30e5c816491f0d6bb666cb fix(opaprocessor): keep rules that compare input objects out of the incremental cache (#4021)
  • * 210af859e9406f6cb2d875b7e5750cf95a3fc341 fix(partitionstore): prevent critical file descriptor leak in fdPool.closeAll on flush failure (#3988)
  • * c44b4c44fa2fe4ce669bcfd90bbf256c8217f847 fix(predict): create output directories and restrict file permissions to 0600 (#4083)
  • * e5f6aa8184d65eb78d5358a985079fff5e5bdcd4 fix(predict): sort SARIF rules for determinism and improve report compatibility (#4097)
  • * bf42abb3a49d7254cd64049e9b7b46b241a263f4 fix(printer): keep multi-line control remediation inside the markdown report blockquote (#4061)
  • * 3bb8dfcdc4d5c2332bc9820b524c617bc4e00c1d fix(pss): match the Kubernetes Pod Security Standards evaluator (#4036)
  • * ebc2fc64a0bd75d468845f5ada98beb4255114d6 fix(rbacgraph): handle an empty name in resourceNames as the authorizer does (#4117)
  • * 2bfda3a4878ae4166faa36cbba4ccbc269610954 fix(rbacgraph): keep resourceNames restrictions literal (#4088)
  • * c99934920d6d0439b79bc02d0a3b18aaa186fc45 fix(rbacgraph): resolve a ServiceAccount subject without a namespace in its RoleBinding's namespace (#4053)
  • * 6017cc02d00545001c99ada2511801bd3b36db09 fix(scan): honor --output /dev/null in --kube-contexts fleet scans (#3846)
  • * af7a944ad8f0b353bd02991e8a1618bc32fc6e18 fix(scan): read SecurityException CRDs only on cluster scans (#4125)
  • * 4ccc405eb1fa687ff0898d3c056bf23632f5e1de fix(scan-integrity): fail closed on whole-cluster verify parity mismatch (#4000)
  • * 80cbaa3016b5564740b8be46a31aca8944befb10 fix(storage): clear remediated findings on later scans (#4044)
  • * c5e20d9828a3aecefbd8a020eb136dc15d4014f1 fix(storage): skip results with non-RBAC related objects instead of aborting persistence (#4057)

value changes (21)

  • * a3960434382346bb0177b321db5b0b7cdd1034b1 chore(deps): bump github.com/kubescape/go-logger from 0.0.34 to 0.0.35 (#4084)
  • * 42456aa5fca3238313e451b46985f4d273e216e1 ci: bump github.com/kubescape/rbac-utils from 0.0.21 to 0.0.22 (#4127)
  • * 0909d9a6710e14023544d5c69ccca9392d314526 ci: bump github.com/kubescape/regolibrary/v2 from 2.0.36 to 2.0.38 (#4126)
  • * e1d3528832e3dcd20b82fbf737c2f788b2c8e846 ci: bump github.com/quay/claircore from 1.5.54 to 1.6.1 (#4129)
  • * 74164da87a09ba6a4562b702b59eb042e9e9f240 ci: bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#4045)
  • * d145b20f0f3c426de8b908450dbbad6e9d797718 ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.45.0 to 1.47.0 (#4047)
  • * af5ce76a4340c6900417a946b02bb5e797663f07 ci: bump golang.org/x/term from 0.46.0 to 0.47.0 (#4128)
  • * bddb17d687f6ece8e78d33d2df30031164d89877 ci: bump google.golang.org/api from 0.297.0 to 0.300.0 (#3961)
  • * d01c1dee4de4398381de0feecbbc69bd33aef482 ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#4049)
  • * 0d924dffc43b1421105bfae6891d2217bc39a3be feat(pdf): report scan coverage and skipped-control diagnostics (#3958) (#3959)
  • * fdc3449bfca517192ab9ac6b7a94d6a0cd376c4f feat(printer): add scan coverage to PDF and docs (#3977)
  • * 5b7739dfd24a73a6bf06fa84bc3db25d7373ed3b feat(printer): include skipped and unevaluated controls in junit report (#4014) (#4015)
  • * 8b3fe4b46ad7bf44ed9a19a69f9a3f32d7a6aeb2 feat(printer): surface attack-path priority score and severity in SARIF result properties (#4004)
  • * 30937b0506d9d14926d56fac14babb6631691bc0 fix(deps): upgrade Trivy to address Dependabot alerts (#4131)
  • * 6421283d45b9a5041d559883c28980b834c01f87 fix(deps): upgrade containerd, cilium and OpenTelemetry to patched releases (#4066)
  • * 369227dbd620665b8b31e99712643ed215c4c904 fix(imagescan): add scan status to vulnerability reports (#4074)
  • * 8e4f2ffcd39b0de507047f494b9ef212241a97ed fix(policyreport): surface cluster-wide skipped controls and diagnostics in ClusterPolicyReport (#3989) (#3990)
  • * 230d2a95e4d33b5cd8f20a549cbaf6256074df2d fix(prometheus): omit complianceScore metric when score is unset (#4017) (#4018)
  • * b1726ab4c0476a870e9aa689992f7947c73f3037 perf(mcpserver): deduplicate concurrent analysis requests (#4146)
  • * 041bce0a68ab3d7bb0a5ccbe4981accccbe203dd perf(opaprocessor): cache prepared rego evaluation queries to reduce scan overhead (#4030)
  • * 88db8bd89ba060597756983bb57877a69d6163e9 perf(partitionstore): avoid redundant DeepCopy before disk serialization in DiskStore.Put (#3971)

additions (15)

  • * 02cd4072fff0f77217223714c48c8f66073ddd64 Feat/rbac parity differential testing (#4076)
  • * 893655274d7ac25a91da41a8713d846e9aa0d9e4 feat(diff): compare image scan reports to surface new and resolved vulnerabilities (#3957)
  • * 3b7b90e2e7aa22b9b020ddd880c024e38692124d feat(fix): add interactive mode for granular remediation (#3914)
  • * 48d62cf39597ccece9dce72b41c821e1e5105ccb feat(fleet): retry clusters whose API server never answered [LFX 2026] (#4113)
  • * 0506387205ce41aee544552c92cc0db1db5a5743 feat(imagescan): add Red Hat Quay vulnerability adaptor (#4081)
  • * 4d883d06f74a539639273b2acfb643e7e0f53362 feat(mcp): add list_admission_policies tool (#4112)
  • * 071a01aae58dcc53833de6cec4176af2fe91c78f feat(mcp): log tool-call metadata at debug level (#4123)
  • * 2e978a7c7a62775cc45cefb9ed5f22396879a306 feat(mcpserver): add PSS compliance prediction tool (#4011)
  • * 856e477f263496d960cfa28b36acc20fefc9cb8f feat(mcpserver): add secret exposure detection tool (#4099)
  • * f96a146afa8853754008090b4a5772dc9a4d99e9 feat(mcpserver): expose scan report comparison via diff_reports tool (#4040)
  • * aff609158ccd199368b867d76d0fede699ef507c feat(pss): add PSS compliance predictor CLI (#4055)
  • * 5a0b79edb9d20dff14418fcd86dd744f2e4ab589 feat(pss): add Pod Security Standards evaluation library (#4003)
  • * 46931e9eef1b867a88643abb88c798434e55d226 feat(scan): add --kube-version and --api-versions for Helm rendering (#4143)
  • * 64ff26aee6a9f5aaabbe9316fb47949ee0be190c fix(prometheus): emit kubescape_resource_count_controls_passed metric (#4013)
  • * 3649b0601615d501f9d5f7cdb1cec5d0549056f9 feat(vulnexposure): account for external exposure in vulnerability analysis (#4064)

constraints (2)

  • * 3b5f86eae29ac01ef7833a8827000e9a9d372a3b fix(config): reject empty config set values instead of silently keeping the old value (#3986)
  • * ba6e27a29c14a1be8a080689e871f9720fed70c0 fix(kustomize): allow only builtin plugins when rendering Kustomizations (#4031)
Kubescape 스택에 추가

조치가 필요한 변경이 나오면 주간 메일로 받아볼 수 있습니다. 이번 릴리스처럼 조치가 없는 주에는 메일을 보내지 않습니다.

스택에 추가 →
공식 릴리스 노트 ↗Kubescape 릴리스 전체 →