CVE-2026-4789
Fixed in a distro release EPSS <1%CVSS 9.8
Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.
Products: kyverno
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kyverno/kyverno | 1.17.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-kyverno-1.16 | no fix |
| Chainguard | commercial-kyverno-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-background-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-reports-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyvernopre-1.16 | no fix |
| Chainguard | commercial-kyvernopre-1.17 | 1.17.2-r0 |
| Chainguard | kyverno-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-background-controller-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-background-controller-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-background-controller-fips-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-background-controller-fips-1.17 | 1.17.1-r11 |
| Chainguard | kyverno-cleanup-controller-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-cleanup-controller-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-cleanup-controller-fips-1.17 | 1.17.1-r11 |
| Chainguard | kyverno-cli-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-cli-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-cli-fips-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-cli-fips-1.17 | 1.17.1-r11 |
| Chainguard | kyverno-fips-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-fips-1.17 | 1.17.1-r11 |
| Chainguard | kyverno-init-container-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-init-container-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-init-container-fips-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-init-container-fips-1.17 | 1.17.1-r11 |
| Chainguard | kyverno-notation-aws-fips | 1.1-r46 |
| Chainguard | kyverno-readiness-checker-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-readiness-checker-fips-1.17 | 1.17.1-r11 |
| Chainguard | kyverno-reports-controller-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-reports-controller-1.17 | 1.17.1-r13 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 1.16.3-r13 |
| Chainguard | kyverno-reports-controller-fips-1.17 | 1.17.1-r11 |
| Wolfi | kyverno-1.16 | 1.16.3-r13 |
| Wolfi | kyverno-1.17 | 1.17.1-r13 |
| Wolfi | kyverno-background-controller-1.16 | 1.16.3-r13 |
| Wolfi | kyverno-background-controller-1.17 | 1.17.1-r13 |
| Wolfi | kyverno-cleanup-controller-1.16 | 1.16.3-r13 |
| Wolfi | kyverno-cleanup-controller-1.17 | 1.17.1-r13 |
| Wolfi | kyverno-cli-1.16 | 1.16.3-r13 |
| Wolfi | kyverno-cli-1.17 | 1.17.1-r13 |
| Wolfi | kyverno-init-container-1.16 | 1.16.3-r13 |
| Wolfi | kyverno-init-container-1.17 | 1.17.1-r13 |
| Wolfi | kyverno-readiness-checker-1.17 | 1.17.1-r13 |
| Wolfi | kyverno-reports-controller-1.16 | 1.16.3-r13 |
| Wolfi | kyverno-reports-controller-1.17 | 1.17.1-r13 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Tumbleweed | kyverno | 1.17.2-1.1 |