v1.15
Contains release notes of Nirmata Enterprise for Kyverno v1.15
The latest version of the 1.15 release of Enterprise Kyverno is v1.15.2-n4k.nirmata.14, released September 5, 2026.
For a complete list of changes, refer to the upstream Changelog.
v1.15.2-n4k.nirmata.14 — September 5, 2026
| CVE | Component | Severity | Fix type | Image(s) affected | Notes |
|---|---|---|---|---|---|
| GHSA-qr4g-8hrp-c4rw | Kyverno engine (context.apiCall.service) | High | Code change | kyverno, background-controller | SSRF guard applies a default egress blocklist (cloud metadata, loopback) to policy-initiated apiCall.service requests |
| GHSA-459x-q9hg-4gpq | Kyverno engine (context.apiCall.service) | High | Code change | kyverno, background-controller | Companion advisory to the apiCall.service SSRF hardening |
| GHSA-rggm-jjmc-3394 | CEL http.Get/http.Post | High | Code change | all controllers | CEL policy compilers now route http.* calls through the guarded dialer; closes the previously unguarded 1.15 CEL path |
| CVE-2025-68121 | Go standard library | Critical | Library bump | all images | Go toolchain 1.25.6 → 1.25.13 |
| CVE-2026-33186 | google.golang.org/grpc | Critical | Library bump | all images | grpc 1.77.0 → 1.82.1 |
| GHSA-5cgq-3rg8-m6cv | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.46.0 → 0.53.0 |
| GHSA-89gr-r52h-f8rx | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.46.0 → 0.53.0 |
| GHSA-f5wc-c3c7-36mc | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.46.0 → 0.53.0 |
| GHSA-rm3j-f69w-wqmq | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.46.0 → 0.53.0 |
| GHSA-vgwf-h737-ff37 | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.46.0 → 0.53.0 |
| CVE-2026-25681 | golang.org/x/net | High | Library bump | all images | x/net 0.48.0 → 0.56.0 |
| CVE-2026-48702 | github.com/sigstore/rekor | High | Library bump | all images | rekor 1.3.10 → 1.5.2 |
| CVE-2026-49478 | github.com/sigstore/fulcio | High | Library bump | all images | fulcio 1.8.3 → 1.8.6 |
| CVE-2026-45022 | github.com/go-git/go-git/v5 | High | Library bump | all images | go-git/v5 5.16.2 → 5.19.2 |
| CVE-2026-50151 | oras.land/oras-go/v2 | High | Library bump | all images | oras-go/v2 2.5.0 → 2.6.2 |
| CVE-2026-56852 | golang.org/x/text | High | Library bump | all images | x/text 0.32.0 → 0.39.0 |
| CVE-2026-34986 | github.com/go-jose/go-jose | High | Library bump | all images | go-jose/v3 3.0.4 → 3.0.5, go-jose/v4 4.1.3 → 4.1.4 |
| CVE-2025-15558 | github.com/docker/cli | High | Library bump | all images | docker/cli 29.0.3 → 29.4.0 |
Beyond the rows above, this release clears roughly 60 further High-severity standard library and Go-module CVEs, remediated in bulk by the Go toolchain bump (1.25.6 → 1.25.13) plus module updates including x/crypto 0.53.0, x/net 0.56.0, x/mod 0.40.0, gRPC 1.82.1, OpenTelemetry 1.43.0, sigstore/rekor 1.5.2 and fulcio 1.8.6, go-git/v5 5.19.2, go-billy/v5 5.9.0, and oras-go/v2 2.6.2.
Fixes
- The kyverno-init container now treats missing reports CRDs as a no-op instead of failing.
- The webhook now infers a
Namespacedscope for namespace-constrained wildcard policies. - Fixed
matchImageReferencesso it filters images properly.
Additional changes
- Fixed a build-context leak in all six FIPS Dockerfiles that shipped the full source tree and dev binaries into published FIPS images, removing roughly 120 leaked critical and high CVEs and shrinking the
kyvernoFIPS image from about 1.5 GB to 251 MB. - Moved the FIPS builder and runtime bases from CBL-Mariner 2.0 to Azure Linux 3.0 to carry the Go 1.25.13 toolchain.
- Updated the bundled reports-server to 0.2.28 and added the Nirmata proprietary license.
v1.15.2-n4k.nirmata.11 — March 10, 2026
Fixes
- Upgraded the reports-server to 0.2.17 and the bundled kubectl to 1.35.0.
- Added support for generate policy events.
v1.15.2-n4k.nirmata.10 — January 30, 2026
| CVE | Component | Severity | Fix type | Image(s) affected | Notes |
|---|---|---|---|---|---|
| CVE-2025-66506 | sigstore/fulcio | High | Library bump | all images | Fulcio excessive memory allocation during token parsing; fixed by bumping the sigstore dependency |
| CVE-2025-66564 | sigstore/timestamp-authority | High | Library bump | all images | Timestamp Authority excessive memory allocation during request parsing; fixed by bumping the sigstore dependency |
Additional changes
- Library bump: upgraded the Go toolchain from 1.24 to 1.25.6 to address Go runtime security vulnerabilities.
- Base image: aligned the FIPS Dockerfiles with the Go 1.25.6 requirement so FIPS release images build cleanly.
v1.15.2-n4k.nirmata.1 — September 22, 2025
Bug Fixes
- Backport a bug fix for custom messages in pod controllers (PR #13952).
v1.15.1-n4k.nirmata.1 — September 1, 2025
New Policy Types
- MutatingAdmissionPolicy (MPOL) with admission flow integration, background reporting, mutate existing resources, and CLI support
- GeneratingPolicy (GPOL) with admission flow integration, background reporting, generate existing resources, and CLI support
- DeletingPolicy (DPOL) with in-cluster and off-cluster cleanup capabilities via CLI operations
OpenReports Integration (Alpha)
- Switched policy reports to OpenReports implementation
CLI Enhancements
- Multiple output formats (JSON, YAML, Markdown, JUnit) for test command
- Added
--cluster-wide-resourcesflag to apply command - Added
skipColorflag for CLI output - Support for cloning from private repositories in apply command
- Fixed YAML separator support in LoadTest with proper error handling
Changes
- ValidatingAdmissionPolicy generation enabled by default
- Renamed CEL operator
image()toparseImageReference - Removed deprecated CLI APIs
- Improved ValidatingAdmissionPolicy performance
Bug Fixes
- Fixed JSON logging format issues
- Fixed panic when resolving kinds fails for CEL-based policies
- Fixed GlobalContextEntry refresh interval updates
- Fixed reports controller wildcard resource matching
- Fixed shallow variable escaping during validation
- Updated OpenReports module references
Helm Chart Updates
- Added MutatingAdmissionPolicy and ValidatingAdmissionPolicy CRDs
- Enhanced ServiceMonitor annotations support
- Added PodDisruptionBudget configuration options
- Service account token automount configuration
- Support for Kubernetes 1.31+ traffic distribution
Dependencies
- Bumped Kubernetes dependencies to v1.33
- Updated security and tooling dependencies
| CVE | Component | Severity | Fix type | Image(s) affected | Notes |
|---|---|---|---|---|---|
| CVE-2025-47907 | Go standard library (database/sql) | High | Library bump | all images | Fixed by upgrading the Go toolchain |