# Kyverno v1.20.0

> Security · 2026-11-12

A substantial feature and maintenance release that adds CEL and OCI capabilities while tightening legacy-policy migration and policy behavior. It also includes broad dependency updates and fixes, with operators most affected by legacy policy execution changes, policy and chart constraints, and updated runtime dependencies.

## Action needed
- **[security · critical]** `x/net` updated for `CVE-2026-78663`
  - The `x/net` dependency is updated to resolve `CVE-2026-78663`.
- **[security · high]** `oras.land/oras-go/v2` updated for `CVE-2026-50163`
  - The release updates `oras.land/oras-go/v2` to v2.6.2 to resolve `CVE-2026-50163`.
- **[security · high]** `x/net` updated for `CVE-2026-56853`
  - The `x/net` dependency is updated to fix the HTTP/2 ReadHeaderTimeout evasion described by `CVE-2026-56853`.
- **[security · high]** `Go` 1.26.6 for `CVE-2026-56853`
  - The `Go` version is bumped to 1.26.6 to address `CVE-2026-56853` in the standard library.
- **[security · high]** `miekg/dns` updated for `CVE-2026-46600`
  - The `miekg/dns` dependency is updated to fix the DNS parsing panic described by `CVE-2026-46600`.
- **[security · high]** `Go` 1.27.2 for `CVE-2026-97031`
  - The `Go` version is bumped to 1.27.2 to resolve `CVE-2026-97031`.
- **[security · high]** `golang.org/x/net` updated for `CVE-2026-78669`
  - The `golang.org/x/net` dependency is bumped to resolve `CVE-2026-78669`.
- **[security · medium]** Go 1.27.3 for `CVE-2026-111943`
  - The Go toolchain is bumped to 1.27.3 to protect against `CVE-2026-111943`.
- **[security]** Dependency CVE updates for `oras-go`, `x/mod`, and the Go toolchain
  - Dependency updates patch CVEs in `oras-go`, `x/mod`, and the Go toolchain.
- **[security]** `rekor` dependency replacement for `GO-2026-5932`
  - The `rekor` dependency is replaced to address `GO-2026-5932`.

## Check if affected
- **[security]** `apiCall.service` egress blocklist validation
  - Applies if you configure `apiCall.service`.
  - The IPv6-embedded-IPv4 blocklist bypass in `apiCall.service` egress is closed.
- **[breaking]** Stricter `request.operation` condition validation
  - Applies if you configure `request.operation`.
  - Validation now rejects non-string values in `request.operation` conditions.
- **[breaking]** Non-empty `matchConstraints` for `ImageValidatingPolicy`
  - Applies if you configure `ImageValidatingPolicy` with empty `matchConstraints`.
  - Validation rejects `ImageValidatingPolicy` resources with empty `matchConstraints`.
- **[breaking]** `globalContext` restriction in namespaced policies
  - Applies if you configure `globalContext` in namespaced policies.
  - `globalContext` is denied in namespaced policies.
- **[breaking]** Legacy policy API writes blocked
  - Applies if you use legacy policy APIs.
  - Creates and spec updates of legacy policy APIs are blocked.
- **[breaking]** Default-on Helm gate for legacy policy CRs
  - Applies if you enable legacy policy CRs during installation or upgrade.
  - Helm adds a required default-on gate for legacy policy CRs during installation and upgrade.
- **[breaking]** Legacy policy manifest handling in the CLI
  - Applies if you run the CLI in `apply` or `test`.
  - The CLI blocks legacy policy manifests in `apply` and `test`, with a migration escape hatch.
- **[breaking]** `exceptionNamespace` enforcement for CEL PolicyExceptions
  - Applies if you configure `exceptionNamespace` for CEL PolicyExceptions.
  - The webhook enforces `exceptionNamespace` for CEL PolicyExceptions.
- **[breaking]** Typed policy dependencies for legacy policy writes
  - Applies if you use legacy policy writes without typed policy dependencies.
  - Legacy policy writes are rejected when typed policy dependencies are absent.
- **[breaking]** Legacy policy execution in admission binaries, removed
  - Applies if you use admission binaries.
  - Legacy policy execution is removed from admission binaries.
- **[breaking]** Legacy policy execution in the background controller, removed
  - Applies if you run the background controller.
  - Legacy policy execution is removed from the background controller.
- **[breaking]** Legacy policy evaluation in the reports controller, removed
  - Applies if you run the reports controller.
  - Legacy policy evaluation is removed from the reports controller.
- **[breaking]** Legacy CLI execution and policy-authoring branches, removed
  - Applies if you use legacy CLI execution.
  - Legacy CLI execution and policy-authoring branches are deleted.
- **[breaking]** Frozen legacy CRD schemas and shared Kyverno API types
  - Applies if you configure legacy CRD schemas.
  - The shared Kyverno API types are prepared and legacy CRD schemas are frozen.
- **[breaking]** CEL policy minimum version 1.17.0
  - Applies if you use CEL policies.
  - The minimum version for CEL policies is updated to 1.17.0.
- **[breaking]** Legacy `kyverno.io` policy engine, removed
  - Applies if you run the legacy `kyverno.io` policy engine.
  - The legacy `kyverno.io` policy engine is deleted.
- **[breaking]** Legacy `kyverno.io` Go API, removed
  - Applies if you depend on the legacy `kyverno.io` Go API.
  - The legacy `kyverno.io` Go API is deleted and clients are regenerated.

## Plan ahead
- **[deprecated]** `jmesPath` projections deprecated
  - Applies if you use `jmesPath` projections.
  - `jmesPath` projections are deprecated, and their use is measured.

## Other recorded changes
- 228 (defect_corrected 137, value_changed 60, added 28, constraint_changed 2, removed 1)

[Full analysis](https://ratatosk.io/en/releases/kyverno/v1.20.0)

[Original release notes](https://github.com/kyverno/kyverno/releases/tag/v1.20.0)