CVE-2026-4789

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-478909.8Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring FramCVE-2026-478919.8A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.CVE-2026-478929.8A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a preCVE-2026-478937.5A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headeCVE-2026-478947.5Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. SCVE-2026-478957.5In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are CVE-2026-478967.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator libCVE-2026-478977.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator libCVE-2026-478989.8Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue aCVE-2026-478998.7The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path valiCVE-2026-47905.4The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-479004.6Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its
CVE-2026-4789: Critical severity, CVSS 9.8 | Vulnix