Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Kyverno can be misled by crafted tar files

published 9 months ago
Summary

The Kyverno software that processes tar archives has several weaknesses that could let an attacker supply specially crafted files to cause unexpected behavior or gain access. This could lead to data loss or unauthorized actions on your systems. Update Kyverno to the latest release and apply any vendor patches as soon as possible.

What to do
  • Update cleanstart kyverno to version 1.15.2-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart kyverno < 1.15.2-r0
Fix: upgrade to 1.15.2-r0
Original advisory text
tar
Multiple security vulnerabilities affect the kyverno package. tar. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published30 Jan 2026
Updated9 Sep 2026
First seen9 Sep 2026
Sources
CLEANSTART-2026-RL45001 · OSV
Track software like this
Free during beta