# Kubescape v4.0.21

> Security · 2026-11-13

A feature-rich maintenance release expands scanning, remediation, policy, and reporting capabilities while correcting behavior across RBAC, dependencies, and scan results. Security hardening covers bounded file reads, safer file handling, anonymization, and analysis.

## Action needed
- **[security]** Bounded Helm template file reads
  - Helm template file reads are now bounded and validated in `cautils` to address CWE-400.
- **[security]** Bounded Kustomization file reads
  - Kustomization file reads are now bounded and validated in `cautils` to address CWE-400.
- **[security]** Bounded Terraform file reads
  - Terraform file reads are now bounded and validated in `cautils` to prevent denial of service through CWE-400.
- **[security]** Bounded artifact file reads in `setUseArtifactsFrom`
  - Artifact file reads in `setUseArtifactsFrom` are now bounded and validated in `cautils` to address CWE-400.
- **[security]** Bounded ignore file reads in `LoadIgnoreFilePatterns`
  - Ignore file reads in `LoadIgnoreFilePatterns` are now bounded and validated in `cautils` to address CWE-400.
- **[security]** Bounded report file reads
  - Report file reads are now bounded and validated in `decrypt` to prevent denial of service through CWE-400.
- **[security]** Bounded manifest file reads in `GetFileString`
  - Manifest file reads in `GetFileString` are now bounded and validated in `fixhandler` to address CWE-400.
- **[security]** Bounded manifest reads in `applyFileChanges` and `readManifest`
  - `applyFileChanges` and `readManifest` now bound manifest reads and reject non-regular files in `fixhandler`, addressing CWE-400.
- **[security]** Bounded policy file reads
  - Policy file reads are now bounded and validated in `getter` to prevent denial of service through CWE-400.
- **[security]** Bounded exception file reads
  - Exception file reads are now bounded and validated in `image` to prevent denial of service through CWE-400.
- **[security]** Bounded YAML manifest decoding in `NewPathLocationResolver`
  - `NewPathLocationResolver` now bounds YAML manifest decoding and validates regular files in `locationresolver`, addressing CWE-400.
- **[security]** Bounded policy test case file reads
  - Test case file reads are now bounded and validated in `policytest` to address CWE-400.
- **[security]** Bounded workload manifest reads
  - Workload manifest reads are now bounded and validated in `pss` to prevent denial of service through CWE-400.
- **[security]** Bounded custom rule file reads
  - Custom rule file reads are now bounded and validated in `rules` to prevent denial of service through CWE-400.
- **[security]** Updated image dependencies and `Go toolchain`
  - Vulnerable image dependencies and the `Go toolchain` were updated.
- **[breaking]** The Cluster prefix fallback, removed
  - The Cluster prefix fallback was removed from `vapreconcile`.

## Check if affected
- **[breaking]** Required binding paths for role rewrite grants
  - Applies when processing role rewrite grants.
  - Binding paths are now required for role rewrite grants in `rbacgraph`.
- **[breaking]** Rejected fleet dry runs
  - Applies if you use `--dry-run` for fleet dry runs.
  - Fleet dry runs are rejected when `--dry-run` is used.
- **[breaking]** Shallow remote git repository clones by default
  - Applies if you use remote git repositories.
  - Remote git repositories are now shallow-cloned by default during scans.

## Other recorded changes
- 103 (defect_corrected 86, added 14, value_changed 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/kubescape/v4.0.21)

[Original release notes](https://github.com/kubescape/kubescape/releases/tag/v4.0.21)