CVE-2023-33191

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
kyverno	kyverno	>= 1.9.2, < 1.9.4

References

https://github.com/kyverno/kyverno/pull/7263Issue Tracking
https://github.com/kyverno/kyverno/releases/tag/v1.9.4Release Notes
https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3cVendor Advisory
https://github.com/kyverno/kyverno/pull/7263Issue Tracking
https://github.com/kyverno/kyverno/releases/tag/v1.9.4Release Notes
https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3cVendor Advisory

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-331927.5ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server.CVE-2023-331939.1Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them a CVE-2023-331944.8Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validat CVE-2023-331956.1Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched i CVE-2023-331965.4Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been f CVE-2023-331975.4Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index ut CVE-2023-331987.5tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poiso CVE-2023-331995.3Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed CVE-2023-33208.8The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due CVE-2023-332004.7A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is care CVE-2023-332015.3Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an L CVE-2023-332025.5Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMP