CVE-2023-42816

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.

• CWE-345

• https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2Patch
• https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73bPatch
• https://github.com/kyverno/kyverno/pull/8428Patch
• https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3rVendor Advisory
• https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2Patch
• https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73bPatch
• https://github.com/kyverno/kyverno/pull/8428Patch
• https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3rVendor Advisory

Published

Nov 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42810systeminformation is a System Information Library for Node.J…9.8
• CVE-2023-42811aes-gcm is a pure Rust implementation of the AES-GCM. Starti…5.5
• CVE-2023-42812Galaxy is an open-source platform for FAIR data analysis. Pr…4.3
• CVE-2023-42813Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42814Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42815Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42817Pimcore admin-ui-classic-bundle provides a Backend UI for Pi…5.4
• CVE-2023-42818JumpServer is an open source bastion host. When users enable…9.8
• CVE-2023-42819JumpServer is an open source bastion host. Logged-in users c…8.8
• CVE-2023-4282The EmbedPress plugin for WordPress is vulnerable to unautho…4.3
• CVE-2023-42820JumpServer is an open source bastion host. This vulnerabilit…8.2
• CVE-2023-42821The package `github.com/gomarkdown/markdown` is a Go library…7.5