What’s Vulnerable › Vulnerabilities

CVE-2023-33191: kyverno seccomp control can be circumvented

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-30 · updated 2026-06-17
• Weakness: CWE-284

Description

Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.

Affected products

• Nirmata Kyverno: from 1.9.2 before 1.9.4 — fixed in 1.9.4

How to fix

Upgrade to a fixed version: Nirmata Kyverno 1.9.4. Check the vendor advisory for mitigations.

References

• https://github.com/kyverno/kyverno/pull/7263
• https://github.com/kyverno/kyverno/releases/tag/v1.9.4
• https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c
• https://github.com/kyverno/kyverno/pull/7263
• https://github.com/kyverno/kyverno/releases/tag/v1.9.4
• https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c

Get alerted when CVE-2023-33191 or the next vulnerability affects your stack