--- title: "v1.18" description: "Contains release notes of Nirmata Enterprise for Kyverno v1.18" diataxis: reference applies_to: product: "nirmata-control-hub" audience: ["platform-engineer"] last_updated: 2026-09-06 url: https://docs.nirmata.io/docs/release-notes/n4k/v1.18/ --- The latest version of the 1.18 release of Enterprise Kyverno is **v1.18.0-n4k.nirmata.6**, released September 5, 2026. Enterprise Kyverno 1.18 is built on upstream Kyverno 1.18 and supports Kubernetes 1.33 through 1.37. For the full support matrix, see [Compatibility](/docs/reference/compatibility/). For a complete list of changes, refer to the upstream Changelog. - [v1.18.0](https://github.com/kyverno/kyverno/releases/tag/v1.18.0) — April 29, 2026 - [v1.18.1](https://github.com/kyverno/kyverno/releases/tag/v1.18.1) — May 18, 2026 - [v1.18.2](https://github.com/kyverno/kyverno/releases/tag/v1.18.2) — July 10, 2026 ## v1.18.0-n4k.nirmata.6 — September 5, 2026 | CVE | Component | Severity | Fix type | Image(s) affected | Notes | | --- | --- | --- | --- | --- | --- | | [GHSA-qr4g-8hrp-c4rw](https://github.com/advisories/GHSA-qr4g-8hrp-c4rw), [GHSA-459x-q9hg-4gpq](https://github.com/advisories/GHSA-459x-q9hg-4gpq) | Kyverno engine (`context.apiCall.service`) | High | Code change | kyverno, background-controller, cleanup-controller, reports-controller | Two-phase SSRF guard on `context.apiCall.service` (pre-flight and dial-time checks, closing the DNS-rebinding window); new `--apiCallBlocklist`/`--apiCallAllowlist` flags | | [GHSA-5cgq-3rg8-m6cv](https://github.com/advisories/GHSA-5cgq-3rg8-m6cv) | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.50.0 → 0.55.0 | | [GHSA-89gr-r52h-f8rx](https://github.com/advisories/GHSA-89gr-r52h-f8rx) | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.50.0 → 0.55.0 | | [GHSA-f5wc-c3c7-36mc](https://github.com/advisories/GHSA-f5wc-c3c7-36mc) | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.50.0 → 0.55.0 | | [GHSA-rm3j-f69w-wqmq](https://github.com/advisories/GHSA-rm3j-f69w-wqmq) | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.50.0 → 0.55.0 | | [GHSA-vgwf-h737-ff37](https://github.com/advisories/GHSA-vgwf-h737-ff37) | golang.org/x/crypto | Critical | Library bump | all images | x/crypto 0.50.0 → 0.55.0 | | [CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828) | golang.org/x/crypto | High | Library bump | all images | x/crypto 0.50.0 → 0.55.0 | | [CVE-2026-45022](https://nvd.nist.gov/vuln/detail/CVE-2026-45022) | github.com/go-git/go-git/v5 | High | Library bump | all images | go-git/v5 5.18.0 → 5.19.2 | | [CVE-2026-44973](https://nvd.nist.gov/vuln/detail/CVE-2026-44973) | github.com/go-git/go-billy/v5 | High | Library bump | all images | go-billy/v5 5.8.0 → 5.9.1 | | [CVE-2026-49478](https://nvd.nist.gov/vuln/detail/CVE-2026-49478) | github.com/sigstore/fulcio | High | Library bump | all images | fulcio 1.8.5 → 1.8.8 | | [CVE-2026-48702](https://nvd.nist.gov/vuln/detail/CVE-2026-48702) | github.com/sigstore/rekor | High | Library bump | all images | rekor 1.5.1 → 1.5.4 | | [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) | golang.org/x/mod | High | Library bump | all images | x/mod 0.35.0 → 0.40.0 | | [CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) | golang.org/x/net | High | Library bump | all images | x/net 0.53.0 → 0.58.0 | | [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852) | golang.org/x/text | High | Library bump | all images | x/text 0.36.0 → 0.41.0 | | [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) | Go standard library | High | Library bump | all images | Go toolchain 1.26.3 → 1.26.7 | Beyond the rows above, the remaining scanner findings in this batch were cleared by the same module and toolchain bumps: the Go toolchain (1.26.3 → 1.26.7), `golang.org/x/crypto` (0.50.0 → 0.55.0), `go-git`, `fulcio`, `rekor`, `golang.org/x/mod`, `google.golang.org/grpc` (1.80.0 → 1.83.2), and `oras.land/oras-go/v2` (2.6.0 → 2.6.2). All findings were Go standard library or Go module issues; the Wolfi runtime base image was not affected. ### Fixes - Stopped a reports-server watcher leak that caused an out-of-memory cascade. - Inferred a `Namespaced` webhook scope for namespace-constrained wildcard policies, and backported the related namespaced-policy fixes. - Handled missing reports CRDs as a no-op in `kyverno-init` so initialization no longer fails when the reports CRDs are absent. - Granted `watch` on deleting policies to the licensing informers so the live policy counter stays in sync. - Pointed the webhooks-cleanup readiness checker at the Nirmata image. ### Additional changes - Added the `--apiCallBlocklist` and `--apiCallAllowlist` flags (settable through Helm values) to control which destinations `context.apiCall.service` may reach; these are separate from the CEL `--httpBlocklist`/`--httpAllowlist` flags, so in-cluster ClusterIP calls keep working by default. - Extended conformance coverage to Kubernetes 1.36 and 1.37. - Fixed the FIPS image builds: stopped shipping the whole build context, bumped the `kubectl-kyverno` FIPS builder to Go 1.26.7, and mounted the private-module secret in the `kubectl-kyverno` FIPS build. ## v1.18.0-n4k.nirmata.2 — August 17, 2026 ### Licensing - Added a free community tier so open-source use runs without a commercial license. - Enforced commercial licensing for policy capacity and commercial features. - Set the license evaluation interval to 15 minutes. - Included licensing fixes for enterprise deployments. | CVE | Component | Severity | Fix type | Image(s) affected | Notes | | --- | --- | --- | --- | --- | --- | | [CVE-2026-32952](https://nvd.nist.gov/vuln/detail/CVE-2026-32952) | github.com/Azure/go-ntlmssp | Medium | Library bump | all images | Bumped to v0.1.1; malformed NTLM challenge payloads could trigger a panic. Also tracked as [GHSA-pjcq-xvwq-hhpj](https://github.com/advisories/GHSA-pjcq-xvwq-hhpj). | ### Additional changes - **Base image:** bumped Go to 1.26.3 across the FIPS Dockerfiles and toolchain to pick up the latest runtime security fixes.