v1.14

Contains release notes of Nirmata Enterprise for Kyverno v1.14

The latest version of the 1.14 release of Enterprise Kyverno is v1.14.4-n4k.nirmata.7, released September 5, 2026.

For a complete list of changes, refer to the upstream Changelog.

v1.14.0 — April 25, 2025
v1.14.1 — April 30, 2025
v1.14.2 — June 3, 2025
v1.14.3 — June 19, 2025
v1.14.4 — June 26, 2025

v1.14.4-n4k.nirmata.7 — September 5, 2026

CVE	Component	Severity	Fix type	Image(s) affected	Notes
GHSA-qr4g-8hrp-c4rw	`context.apiCall.service` (engine)	High	Code change	all controllers	Backported dial-time SSRF filter with a default metadata/link-local/loopback blocklist; tunable via `--apiCallBlocklist`/`--apiCallAllowlist`.
GHSA-459x-q9hg-4gpq	`context.apiCall.service` (engine)	High	Code change	all controllers	Same `context.apiCall` SSRF guard; blocks policy-initiated requests to cloud metadata and loopback endpoints.
GHSA-rggm-jjmc-3394	CEL `http.Get`/`http.Post` (engine)	High	Code change	all controllers	Previously unguarded CEL `http.*` path now routes through the shared egress-filter guard; tunable via `--httpBlocklist`.
GHSA-5cgq-3rg8-m6cv	golang.org/x/crypto	Critical	Library bump	all images	Cleared by x/crypto 0.46.0 → 0.53.0
GHSA-89gr-r52h-f8rx	golang.org/x/crypto	Critical	Library bump	all images	Cleared by x/crypto 0.46.0 → 0.53.0
GHSA-f5wc-c3c7-36mc	golang.org/x/crypto	Critical	Library bump	all images	Cleared by x/crypto 0.46.0 → 0.53.0
GHSA-rm3j-f69w-wqmq	golang.org/x/crypto	Critical	Library bump	all images	Cleared by x/crypto 0.46.0 → 0.53.0
GHSA-vgwf-h737-ff37	golang.org/x/crypto	Critical	Library bump	all images	Cleared by x/crypto 0.46.0 → 0.53.0
CVE-2026-25681	golang.org/x/net	High	Library bump	all images	Cleared by x/net 0.48.0 → 0.56.0
CVE-2026-27136	golang.org/x/net	High	Library bump	all images	Cleared by x/net 0.48.0 → 0.56.0
CVE-2026-29181	go.opentelemetry.io/otel	High	Library bump	all images	Cleared by the OpenTelemetry family 1.40.0 → 1.43.0
CVE-2026-45022	github.com/go-git/go-git/v5	High	Library bump	all images	Cleared by go-git 5.14.0 → 5.19.2
CVE-2026-27145	Go standard library	High	Library bump	all images	Cleared by the Go toolchain 1.25.8 → 1.25.13
CVE-2026-32280	Go standard library	High	Library bump	all images	Cleared by the Go toolchain 1.25.8 → 1.25.13

Beyond the rows above, the same batch clears roughly 60 more High-severity Go standard library and module findings through the Go toolchain bump (1.25.8 → 1.25.13) and dependency bumps to golang.org/x/crypto, golang.org/x/net, golang.org/x/text, golang.org/x/mod, go-git/go-billy, the OpenTelemetry family, google.golang.org/grpc, oras-go, and sigstore/rekor.

Additional changes

Migrated the FIPS images from CBL-Mariner 2.0 to Azure Linux 3.0 (builder microsoft/golang:1.25.13-azurelinux3.0, runtime azurelinux/distroless/base:3.0) to match the Go 1.25.13 toolchain.
Fixed the FIPS Dockerfiles so runtime images ship only the built binary instead of the whole build context, cutting the kyverno FIPS image from ~1.5 GB to ~272 MB and removing leaked dev-tool binaries.
Hardened policy-initiated API and registry calls with context propagation, an HTTP request timeout, and scoped-token authorization.
Added the Nirmata proprietary license.

v1.14.4-n4k.nirmata.6 — March 10, 2026

Fixes

Added support for generate policy events.

v1.14.4-n4k.nirmata.5 — January 30, 2026

CVE	Component	Severity	Fix type	Image(s) affected	Notes
CVE-2026-22039	Policy engine (`apiCall`)	Critical	Code change	kyverno, background-controller, reports-controller	Cross-namespace privilege escalation via policy `apiCall`; namespace isolation enforced for `apiCall` context entries in namespaced policies. Also tracked as GHSA-8p9x-46gm-qfx2.
CVE-2026-23881	Policy engine (context)	High	Code change	kyverno, background-controller, reports-controller	Denial of service via context-variable amplification; adds a cumulative global context size limit (2 MB default). Also tracked as GHSA-r2rj-wwm5-x6mq.

Additional changes

Library bump: refreshed third-party dependencies across all images — Go toolchain 1.25.5, golang.org/x/crypto v0.46.0, golang.org/x/text v0.32.0, sigstore/cosign/v2 v2.5.0, sigstore/rekor v1.5.0, gRPC v1.78.0, OpenTelemetry v1.38.0, and go-containerregistry v0.20.7.

v1.14.4-n4k.nirmata.1 — September 18, 2025

Contains the backport fix for lastRefreshInterval of GlobalContextEntry (PR #13700).

CVE	Component	Severity	Fix type	Image(s) affected	Notes
CVE-2025-47907	Go standard library (`database/sql`)	High	Library bump	all images	Fixed by upgrading the Go toolchain to 1.24.6; FIPS images rebased to the matching FIPS Go 1.24.6 base image

v1.14.3-n4k.nirmata.4 — August 11, 2025

Bug Fixes

Controller Report Breaker Enhancement (PR #13641)

Fixed a critical issue where controller initialization would fail completely if ephemeral reports list+watch operations encountered errors. This problem particularly affected clusters that depend on the reports server, where server unavailability could block the admission flow and cause serious cluster failures.

The fix implements:

Centralized access to the reports creation entity (reports breaker)
Mock entity replacement when initialization fails
Background retry mechanism to continuously attempt watch establishment
Improved resilience during controller startup

Important Note: This fix addresses initialization-time failures only. Runtime issues are already handled by the existing circuit breaker functionality, which allows the admission workflow to continue normally when reports become unavailable during operation.

Misc

Additional security vulnerability patches
Fixed FIPS image workflow

v1.14.3-n4k.nirmata.2 — July 3, 2025

Major Changes

Reports server is now disabled by default. If you are using Nirmata Enterprise for Kyverno, and want to install the reports-server chart, set the following values in the values.yaml file.

helm install kyverno --namespace kyverno --create-namespace nirmata/kyverno --set crds.reportsServer.enabled=true
```text
Starting this release, the default value of `crds.reportsServer.enabled` has changed from `true` to `false`.

**Reports Server Updates:**
* Added support for etcd compaction (auto compaction enabled by default). Use the `config.etcd.autoCompaction.mode` and `config.etcd.autoCompaction.retention` fields to override the default values.
* Optionally configure HPA for reports-server. Autoscaling is disabled by default. Use the `autoscaling.enabled` field to turn it on and also specify the HPA behavior.
* Added default resource requests and limits for reports-server pod. However, it is recommended to monitor for these values in production and adjust accordingly.

## v1.14.3-n4k.nirmata.1 — June 27, 2025

### Known Issues

**Report Server Installation Advisory**

In Nirmata Enterprise for Kyverno versions 1.13.6 and 1.14, we have removed the built-in Reports Server dependency from the Nirmata Enterprise for Kyverno Helm chart to avoid installation conflicts. This change was driven by an upstream Kubernetes issue where multiple components serving the same CustomResourceDefinitions (CRDs) via an APIService can lead to OpenAPI handler failures during cluster startup.

In our case, the Reports Server serves the same report-related CRDs that Kyverno uses. When these CRDs are present both via the APIService (Reports Server) and within Kyverno’s installation, the Kubernetes apiserver may detect duplicate API paths, resulting in temporary failures, including potential crash loops of Kyverno pods until the APIService becomes fully available.

To mitigate this:
* Install **Reports Server first**, allowing its APIService to register the report CRDs.
* Once the Reports Server is fully up and its APIService is ready, install **Nirmata Enterprise for Kyverno** separately, so that Kyverno can detect the existing CRDs without attempting to install them again.

This installation sequence avoids CRD conflicts and ensures stable operation.

We **strongly recommend** keeping Reports Server and Enterprise Kyverno as separate Helm deployments until we deliver a patch that supports a consolidated Helm chart.

Refer to the following guides for separate deployments:

* [Nirmata Enterprise for Kyverno with Reports Server](/docs/controllers/n4k/reports-server/#installation)
* [Nirmata Enterprise for Kyverno without Reports Server](/docs/controllers/n4k/getting-started-with-n4k/)