GHSA-8p9x-46gm-qfx2: github.com/kyverno/kyverno fixed in 1.16.3 and 1.15.3

GHSA-8p9x-46gm-qfx2 PUBLISHED CVSS 9.899999618530273 CRITICAL

Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

Record from GitHub Advisory Database · Published January 27, 2026

github.com/kyverno/kyverno is fixed in 1.16.3 and 1.15.3 (Go Modules)

Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/kyverno/kyverno	Go Modules	1.16.3, 1.15.3
kyverno-1.13	Wolfi	1.13.6-r13
kyverno-fips-1.14	Chainguard	1.14.5-r5
kyverno-1.14	Chainguard	1.14.5-r5
kyverno-1.14	Wolfi	1.14.5-r5
kyverno-notation-aws	Chainguard	1.1-r33
kyverno-notation-aws-fips	Chainguard	1.1-r32
kyverno-fips-1.13	Chainguard	1.13.6-r13
kyverno-1.13	Chainguard	1.13.6-r13
kyverno-notation-aws	Wolfi	1.1-r33
kyverno-fips-1.16	Chainguard	1.16.3-r0

Risk scores

CVSS 3.1

9.899999618530273

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
wolfi	kyverno-1.13	0
chainguard	kyverno-fips-1.14	0
chainguard	kyverno-1.14	0
wolfi	kyverno-1.14	0
chainguard	kyverno-notation-aws	0
chainguard	kyverno-notation-aws-fips	0
chainguard	kyverno-fips-1.13	0
chainguard	kyverno-1.13	0
wolfi	kyverno-notation-aws	0
chainguard	kyverno-fips-1.16	0
chainguard	reports-server	*
github.com	kyverno/kyverno	0, 1.16.0-rc.1

Timeline

Jan 27, 2026 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-8p9x-46gm-qfx2
vulnetix vdb fixes GHSA-8p9x-46gm-qfx2

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-8p9x-46gm-qfx2/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →