CVE-2023-54356Low· 3.7▾ SunlitKyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack (CVE-2…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
3.7 → —
low → medium
— → 3.7
medium → low
3.7 → —
low → medium
— → 3.7
medium → low
3.7 → —
low → medium
— → 3.7
medium → low
Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack (CVE-2016-2183), which, over very long-lived TLS connections carrying large volumes of traffic, could allow an attacker to recover small amounts of plaintext. The issue is fixed in Kyverno 1.9.5 and 1.10.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/kyverno/kyverno < 1.9.5Patched in:
github.com/kyverno/kyverno 1.9.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GO-2023-1804NoneKyverno vulnerable due to usage of insecure cipher in github.com/kyverno/kyverno
GHSA-hgv6-w7r3-w4qwMediumKyverno vulnerable due to usage of insecure cipher
CVE-2025-29778Medium· 5.8Kyverno ignores subjectRegExp and IssuerRegExp
CVE-2023-33191Medium· 4.6kyverno seccomp control can be circumvented
CVE-2026-84196High· 7.7Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution
CVE-2026-84200Critical· 9.0Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw