kyverno/kyverno v1.16.4 Release Notes

Published at: 2026-04-23T16:31:55Z

What’s Changed

fix: CVE-2025-68121 (Cherry-pick #15203) by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15218
backport #c558d557349a70cd5de52f761db0bb98b6b8ab57 to 1.16 by @fjogeleit in https://github.com/kyverno/kyverno/pull/15346
Cherry pick #15410 by @fjogeleit in https://github.com/kyverno/kyverno/pull/15426
fix: CVE-2026-24051 (release 1.16) by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15415
chore: add trivy scan workflow (Cherry-pick #15502) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/15515
fix(deps): bump github.com/docker/cli to resolve CVE-2025-15558 by @zyzzmohit in https://github.com/kyverno/kyverno/pull/15528
fix: stdlib CVEs by @eddycharly in https://github.com/kyverno/kyverno/pull/15531
fix: CVE-2026-1229 in release-1.16 by @eddycharly in https://github.com/kyverno/kyverno/pull/15533
fix: CVE-2026-26958 by @eddycharly in https://github.com/kyverno/kyverno/pull/15538
fix: CVE-2025-15558 by @eddycharly in https://github.com/kyverno/kyverno/pull/15542
fix: bump sigstore/rekor to v1.5.1 to fix CVE-2026-23831 by @raajheshkannaa in https://github.com/kyverno/kyverno/pull/15577
fix(security): bump go-tuf/v2 to v2.3.1 to address CVE-2026-23992 by @atharrva01 in https://github.com/kyverno/kyverno/pull/15571
fix: resolve CVE-2025-66564 by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15540
fix: CVE-2026-33186 by @eddycharly in https://github.com/kyverno/kyverno/pull/15656
chore: backport ci changes from main to release-1.16 branch by @eddycharly in https://github.com/kyverno/kyverno/pull/15666
chore: remove unnecessary jobs in conformance tests (Cherry-pick #15662) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/15670
chore: add missing scripts for ci (Cherry-pick #15667) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/15672
fix: CVE-2026-22772 by @zyzzmohit in https://github.com/kyverno/kyverno/pull/15566
fix: bump go-tuf/v2 to v2.4.1 to patch CVE-2026-24686 by @atharrva01 in https://github.com/kyverno/kyverno/pull/15579
[backport] chore(security): disable HTTP in namespaced policies by default (CVE-2026-4789) by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15803
fix: CVEs - Release 1.16 by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15831
fix: use scoped token for request authz (cherry-pick #15779 to release-1.16) by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15801
restrict configmap access for namespaced policies (Cherry-pick #15850) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/15868
fix: add missing .chainsaw.yaml to conformance test directories by @yashrajshuklaaa in https://github.com/kyverno/kyverno/pull/15681
fix(engine): prevent forEach mutation panic [release-1.16] by @realshuting in https://github.com/kyverno/kyverno/pull/15887
chore: release 1.16.4-rc.1 by @realshuting in https://github.com/kyverno/kyverno/pull/15891
fix: resolve CVES for go < 1.25.8 by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15927
ci: remove wrongly backported workflows by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15928
ci: backport fixes by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15931
chore: release v1.16.4 by @realshuting in https://github.com/kyverno/kyverno/pull/15946

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.16.3...v1.16.4

Kyverno V1.15.2 Release Note Kyverno V1.17.1 Release Note