CVE-2026-54523

Critical

Advisory

Published 26 Aug 2026In the index since 14 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.6; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1; of 17,781 indexed, latest versions
Container images: 1; deployed by those charts
Fix available: 1 of 1; affected package

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Carried by container images the latest versions of 1 of 17,781 indexed charts deploy, on 1 image.

Affected package	Affected versions	Fixed in	Images
github.com/kyverno/kyvernogolang	v1.18.1	1.18.2	1

OSV records: GHSA-79gf-7frw-68m9
Also known as: BIT-kyverno-2026-54523, GO-2026-6296

Charts affected

1 by stars

Chart

Latest

Affected images

Radar Score

kyvernoquench-kyverno

0.0.1

1 of 2 See more

kyverno quench-kyverno 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-54523.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/kyvernodigest-pinned	90c78c240157	github.com/kyverno/kyverno@v1.18.1	1.18.2

Open the chart page →

342

Container images carrying it

1 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/quenchworks/images/kyverno	90c78c240157	github.com/kyverno/kyverno@v1.18.1	1.18.2	1