# Kyverno v1.19.1

> Security · 2026-09-10

A security-focused maintenance release with dependency updates and fixes for policy and egress behavior. It also includes correctness changes, deprecation warning enforcement, and a narrowed policy constraint that may require operator changes.

## Action needed
- **[security · critical]** `Go` and `x/net` updates for `CVE-2026-39821`
  - The release updates `Go` to 1.26.6 and `x/net` to resolve `CVE-2026-39821`.
- **[security · high]** `Go` update for `CVE-2026-56853`
  - The release updates `Go` to address `CVE-2026-56853`.

## Check if affected
- **[security]** `PolicyException` scope bypass fix for `GHSA-5cjf-wwfg-pj4c`
  - Applies if you use the `PolicyException` CRD.
  - The release fixes the `PolicyException` scope bypass identified by `GHSA-5cjf-wwfg-pj4c`.
- **[security]** `apiCall.service` egress blocklist bypass fix
  - Applies if you configure `apiCall.service` egress.
  - The release closes the IPv6-embedded-IPv4 blocklist bypass in `apiCall.service` egress.
- **[breaking]** `globalContext` constraint in namespaced policies
  - Applies if you use `globalContext` in namespaced policies.
  - The release denies `globalContext` in namespaced policies.

## Other recorded changes
- 22 (defect_corrected 17, added 2, value_changed 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/kyverno/v1.19.1)

[Original release notes](https://github.com/kyverno/kyverno/releases/tag/v1.19.1)