CVE-2022-47633High· 8.1▾ Twilightkyverno verifyImages rule bypass possible with malicious proxy/registry
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
Users of Kyverno on versions 1.8.3 or 1.8.4 who use verifyImages rules to verify container image signatures, and do not prevent use of unknown registries.
This issue has been fixed in version 1.8.5
Configure a Kyverno policy to restrict registries to a set of secure trusted image registries (sample).
github.com/kyverno/kyverno >= 1.8.3, < 1.8.5Upgrade to a patched release:
github.com/kyverno/kyverno 1.8.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-29778Medium· 5.8Kyverno ignores subjectRegExp and IssuerRegExp
CVE-2023-33191Medium· 4.6kyverno seccomp control can be circumvented
CVE-2026-84196High· 7.7Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution
CVE-2023-54356Low· 3.7Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints
CVE-2026-84200Critical· 9.0Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw
CVE-2026-84199High· 7.7Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature