Affected by GO-2025-3615
and 9 other vulnerabilities
GO-2025-3615: Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
GO-2026-4381: Kyverno Cross-Namespace Privilege Escalation via Policy apiCall in github.com/kyverno/kyverno
GO-2026-4382: Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno
GO-2026-5268: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) in github.com/kyverno/kyverno
GO-2026-5337: Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) in github.com/kyverno/kyverno
GO-2026-5351: Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno
GO-2026-5371: Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
GO-2026-5374: Kyverno Controller Denial of Service via forEach Mutation Panic in github.com/kyverno/kyverno
GO-2026-5575: kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
GO-2026-5594: Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
package
Version:
v1.15.1-rc.3
Opens a new window with list of versions in this module.
Published: Aug 14, 2025
License: Apache-2.0
Opens a new window with license information.
Imports: 24
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
¶
View Source
var (
None = &none
Fail = &fail
Ignore = &ignore
)
func NewController(
controllerName string,
vwcClient controllerutils.ObjectClient[*admissionregistrationv1.ValidatingWebhookConfiguration],
vwcInformer admissionregistrationv1informers.ValidatingWebhookConfigurationInformer,
secretInformer corev1informers.SecretInformer,
deploymentInformer appsv1informers.DeploymentInformer,
webhookName string,
path string,
server string,
servicePort int32,
webhookServerPort int32,
labelSelector *metav1.LabelSelector,
rules []admissionregistrationv1.RuleWithOperations,
failurePolicy *admissionregistrationv1.FailurePolicyType,
sideEffects *admissionregistrationv1.SideEffectClass,
configuration config.Configuration,
caSecretName string,
runtime runtimeutils.Runtime,
autoDeleteWebhooks bool,
webhookCleanupSetup func(context.Context, logr.Logger) error,
postWebhookCleanup func(context.Context, logr.Logger) error,
) controllers.Controller
Source Files
¶
Click to show internal directories.
Click to hide internal directories.