PT-2026-38296 · Kyverno · Kyverno

R0Binak · Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44245

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 2.5.2

Description The PropertyCard.vue component uses the Vue 3 v-html directive, which injects raw HTML and disables auto-escaping. The isURL() function only filters values that parse as http: or https: URLs, allowing any HTML payload not starting with those schemes to bypass the guard and flow directly into the DOM. The affected data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps that can be populated by policy engines or any principal with write access to PolicyReport objects in the cluster.

Recommendations Update to version 2.5.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-KYVERNO-2026-44245

CVE-2026-44245

GHSA-Q98M-7W8C-W388

Affected Products

Kyverno

References · 8

• 🔥 https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44245 · Security Note
• https://osv.dev/vulnerability/BIT-kyverno-2026-44245 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q98m-7w8c-w388 · Vendor Advisory
• https://github.com/kyverno/kyverno · Note
• https://t.me/CVEtracker/53580 · Telegram Post
• https://twitter.com/CVEnew/status/2054340913262936576 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054376384508617033 · Twitter Post