GO-2024-3230
and 13 other vulnerabilities
GO-2024-3230 : Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno
GO-2025-3562 : Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
GO-2025-3615 : Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
GO-2025-3652 : Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno
GO-2025-3823 : Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service in github.com/kyverno/kyverno
GO-2026-4285 : Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno
GO-2026-4381 : Kyverno Cross-Namespace Privilege Escalation via Policy apiCall in github.com/kyverno/kyverno
GO-2026-4382 : Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno
GO-2026-5268 : Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) in github.com/kyverno/kyverno
GO-2026-5337 : Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) in github.com/kyverno/kyverno
GO-2026-5351 : Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno
GO-2026-5371 : Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
GO-2026-5575 : kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
GO-2026-5594 : Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
Discover Packages
github.com/kyverno/kyverno
pkg
engine
wildcards
package
Version:
v1.12.7
Opens a new window with list of versions in this module.
Published: Jan 16, 2025
License: Apache-2.0
Opens a new window with license information.
Imports: 4
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
¶
func ExpandInMetadata(patternMap, resourceMap map[string ]interface{}) map[string ]interface{}
ExpandInMetadata substitutes wildcard characters in map keys for metadata.labels and
metadata.annotations that are present in a validation pattern. Values are not substituted
here, as they are evaluated separately while processing the validation pattern. Anchors
on the tags (e.g. "=(kubernetes.io/*)" will be preserved when the values are expanded.
ReplaceInSelector replaces label selector keys and values containing
wildcard characters with matching keys and values from the resource labels.
¶
Click to show internal directories.
Click to hide internal directories.
Affected by 
Documentation
¶
Source Files