Security-Advisory on Kubewarden

Admission controller 1.37.2 Release

Mon, 17 Aug 2026 00:00:00 +0000

Hi all! This patch release ships several fixes for the community. One of them addresses a CVE, and the others fix usability issues in the secure supply chain features and improve how Gatekeeper Rego runtime handle errors without representing an actual security failure.

AdmissionPolicy unique-name collision enables cross-namespace webhook confusion

Community security researcher Ville Vesilehto found a problem while testing Kubewarden’s namespaced admission policies. These policies should only evaluate resources in their own namespace. Ville’s finding shows that wasn’t always true.

Admission Controller 1.37 Release

Mon, 27 Jul 2026 00:00:00 +0000

Here we are, at the tail end of July. Belugas are migrating up north for the season, green turtles are moving to the islands for nesting, and spawned sardines are moving up the east coast of Africa. Kubewarden doesn’t want to miss this season!

Migration to new single Helm chart admission-controller-6.0.0

Since its inception, the Kubewarden Admission Controller has shipped as 3 separate Helm charts: kubewarden-crds, kubewarden-controller, and kubewarden-defaults.

This was done for flexibility: it allowed cluster operators to install/uninstall CRDs, recommended policies and PolicyServers on its own, and bump each part of the stack separately.

Admission Controller 1.35 Release

Mon, 27 Apr 2026 00:00:00 +0000

This Admission Controller 1.35 release is one that builds the nest properly: load-bearing branches first, then careful weaving. A moderate security vulnerability has been fixed, and rather than a quick twig stuffed in a gap, the team reinforced the whole structure. This release brings also a new policy, an expansion on our threat model, and a JavaScrypt/TypeScrypt SDK relocation.

Security fix: RBAC reconnaissance and host capability calls

Kubewarden makes the following security promise:

Admission Controller 1.33 Release

Mon, 09 Mar 2026 00:00:00 +0000

The garden is thriving and Kubewarden 1.33 is ready to bloom! Following last release’s big repotting, this one is serious about pruning, including a security issue. It’s not all housekeeping though, fresh flowers are blooming and come with nice features: BYO-PKI landing in the policy-server, field mask filtering for context-aware calls, proxy support, and a few more treats. Let’s dig in!

Security fix: Cross-namespace data access, removal of deprecated API calls

In our previous post we explained how our architecture protects namespaced policy users from privilege escalations. While this still stands, Ville Vesilehto (thevilledev on GitHub) found the following security vulnerability: an attacker with permissions to create AdmissionPolicies could make use of 3 deprecated host-callbacks (kubernetes/ingresses, kubernetes/namespaces, kubernetes/services) to craft a policy that would allow them read access to Ingresses, Namespaces, and Services resources respectively.

Not affected by cross-ns privilege escalation via policy api call

Mon, 16 Feb 2026 00:00:00 +0000

Why Kubewarden is not affected by CVE-2026-22039

The recent vulnerability CVE-2026-22039 is doing the rounds in the Kubernetes security community, with dramatic titles such as “How an admission controller vulnerability turned Kubernetes namespaces into a security illusion”. You can read about people doubting admission controllers, claiming they have too much power, or they represent too high a value target.

In this blogpost, we reassure Kubewarden users that they aren’t affected thanks to our architecture, and explain why.

Kubewarden 1.24 release

Wed, 30 Apr 2025 00:00:00 +0000

The wait is over, Kubewarden 1.24 has arrived! We have some Easter eggs for you in this one.

Promoting our policies to v1.0.0

In the past, we consciously picked semver 0.X.Y for policy versions as that meant that the policy API for the user (in this case, the policy spec.settings) was not considered stable.

Since the settings of our policies haven’t changed since their initial release, we decided it was time to highlight their stability by promoting them to v1.0.0.

Ingress-nginx CVE-2025-1974 - how Kubewarden can help you

Thu, 03 Apr 2025 00:00:00 +0000

Last week, a high severity issue CVE-2025-1974 was found affecting ingress-nginx, one of the most used ingress solutions for Kubernetes.

The issue

The issue allows an attacker to execute arbitrary code in the Pod running the controller. The attacker can then steal the Kubernetes identity of the nginx-ingress controller which, by design, has access to all the Secrets defined in the cluster.

The issue is exploited by making http requests against the validating webhook server used by the nginx-ingress controller. Only the Kubernetes API server should be allowed to make requests against the webhook endpoint. However, it was discovered that certain clusters are even exposing this webhook endpoint outside of the cluster, for example by using an Ingress resource.

Kubewarden 1.21 release

Thu, 30 Jan 2025 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.21, our first release of 2025!

The release addresses two security issues that the Kubewarden team has discovered. Detailed information about them is included below. While these issues do not have a critical impact, we recommend our users upgrade their Kubewarden deployments.

Alongside these security fixes, the 1.21 release includes the usual stream of dependency updates and features some improvements to our documentation.

Kubewarden 1.16 release

Mon, 19 Aug 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.16.0! Following the northern hemisphere summer, this version packs some goodies but is a bit more lightweight than usual.

kwctl scaffold for AdmissionRequests

The kwctl cli has learned a new command, kwctl scaffold admission-request, which prints a Kubernetes AdmissionRequest object from the provided Kubernetes resource definition.

This is useful when developing policies (and not only limited to Kubewarden ones). Now, you can scaffold the desired AdmissionRequest the policy would receive, and then end-to-end test a Kubewarden policy against the created AdmissionRequest with kwctl run. For example, here we scaffold a request to create an Ingress object, which then we use to test one of our policies out of cluster:

Kubewarden 1.6.0 is released!

Mon, 17 Apr 2023 00:00:00 +0000

We are pleased to announce the availability of the Kubewarden 1.6.0 stack.

This release brings stability, performance and security improvements. All packed with a new major feature. Let’s dig into the changes!

Security Improvements

The Kubewarden controller is ran using a dedicated Service Account. Prior to this release, the Service Account had access to a series of Kubernetes resources across the entire cluster.

Starting from this release, the Kubewarden controller Service Account has a more limited access to the cluster. Access to some resources is now tied to the Namespace inside of which the controller is deployed.

CRI-O CVE-2022-0811 Mitigation

Tue, 29 Mar 2022 00:00:00 +0000

Recently a severe CVE in the CRI-O container engine come to public. The flaw in CRI-O allows bad actors to gain root access and run arbitrary code in the host machine.

A fix for the issue is already available and you should update your cluster to avoid any headache in the future. But if you cannot do that right away, use Kubewarden to mitigate the impact of this issue. It’s possible to prevent pods with sysctl configuration to run in the cluster with the policy sysctl-psp available in the Policy Hub.