What kubescape/kubescape shipped
Written by FoxPlug from the repository's own releases; not affiliated with Kubescape. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/kubescape/kubescape; Kubescape did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Added a kubescape predict pss command that predicts Pod Security Standards compliance for namespaces and workloads, with pretty, table, JSON, SARIF and JUnit output. Pull request #4055
- Added a Red Hat Quay container image vulnerability adaptor covering quay.io and self-hosted registries. Pull request #4081
- Vulnerability exposure analysis now accounts for workloads externally reachable through a Service, Ingress or Gateway API route. Pull request #4064
- CEL policy evaluation now collects Namespace context even when live scans use a workload label selector or kind filter. Pull request #4062
- NetworkPolicy reachability now reports hostNetwork pods as unknown instead of isolated. Pull request #4060
- Upgraded containerd, cilium and OpenTelemetry modules to patched releases for advisories reported as reachable by govulncheck. Pull request #4066
- The E2E step now reads its run ID from the dispatch response instead of searching recent workflow runs. Pull request #4068
- Prepared rego evaluation queries are now cached, so the same rule is no longer compiled and prepared for every evaluated resource. Pull request #4030
- Kustomization rendering now allows only builtin plugins, so a scanned directory can no longer start a container image. Pull request #4031
- Later scans now clear remediated findings, so a control that failed before can become passed. Pull request #4044
Why it matters
Fixes this week cover correctness in areas people rely on: exposure and network reachability results, PSS compliance prediction, image scan status and severity reporting, and storage of scan results. Two changes tighten what a scan can do on your machine: Kustomization rendering is limited to builtin plugins, and scan output files are created with 0600 permissions. Several modules with reachable advisories were also upgraded.
Changelog entry
- Added kubescape predict pss for Pod Security Standards compliance prediction with namespace, level, workload, format and output options. Pull request #4055
- Added a
predict_pss_complianceMCP tool that scans supported workload kinds against the requested Pod Security Standard. Pull request #4011 - Added a Red Hat Quay container image vulnerability adaptor with vulnerability reports, scan status and image metadata. Pull request #4081
- Vulnerability exposure analysis now includes workloads externally reachable through a Service, Ingress or Gateway API route. Pull request #4064
- Gateway exposure now checks listener hostname overlap before reporting a route as exposing its backend Service. Pull request #4089
- CEL evaluation now collects Namespace context for live scans using workload label selectors or kind filters. Pull request #4062
- NetworkPolicy reachability reports hostNetwork pods as unknown instead of isolated. Pull request #4060
- Vulnerability reports now carry scan status for scanned, queued, unsupported, failed and unknown states. Pull request #4074
- Later scans now clear previously remediated findings instead of merging with persisted status. Pull request #4044
- Upgraded containerd, cilium and OpenTelemetry to patched releases. Pull request #4066
- Kustomization rendering now allows only builtin plugins. Pull request #4031
- Scan result files are created with 0600 permissions and filesystem paths are redacted from scan errors returned to clients. Pull request #4016
This week: kubescape predict pss for Pod Security Standards, a Quay image vulnerability adaptor, external exposure in vulnerability analysis, hostNetwork pods reported as unknown, and patched containerd, cilium and OpenTelemetry. Plus stricter Kustomize plugin rendering and 0600
This week in Kubescape: a new kubescape predict pss command predicts Pod Security Standards compliance for namespaces and workloads with pretty, table, JSON, SARIF and JUnit output. A Red Hat Quay adaptor joins container image vulnerability scanning, and vulnerability exposure analysis now counts workloads reachable externally through a Service, Ingress or Gateway API route. NetworkPolicy reachability reports hostNetwork pods as unknown rather than isolated, and containerd, cilium and OpenTelemetry were upgraded to patched releases. On the hardening side, Kustomization rendering now allows only builtin plugins and scan output files are created with 0600 permissions.
Week of September 28, 2026
What shipped
- Pod Security Standards evaluation library added in Phase 1, providing foundational engine for evaluating Kubernetes workloads against Privileged, Baseline, and Restricted levels per Kubernetes v1.31 specification. Pull request #4003
- Red Hat Quay container image vulnerability adaptor implemented, enabling Kubescape to pull Clair-backed vulnerability data directly from Quay registries including self-hosted instances. Pull request #3917
- Image scan report diffing added to kubescape diff, allowing comparison of two scan image reports to surface new and resolved vulnerabilities. Pull request #3957
- Interactive mode (-i/--interactive flag) introduced for kubescape fix command, enabling granular per-resource remediation confirmation instead of single global confirmation. Pull request #3914
- Whole-cluster policy verify mode now fails closed on parity mismatch between projected and fallback evaluation instead of merging suspect verdicts and exiting successfully. Pull request #4000
- O(N²) memory allocation bottleneck eliminated in image scan target deduplication during kubescape scan --scan-images operations. Pull request #3939
- Critical file descriptor and disk space leak in partitionstore.DiskStore fixed, preventing resource exhaustion when writer flushing encounters errors during shutdown. Pull request #3988
- Guard test added over go.mod replace directives to prevent unintended dependency replacements in the build. Pull request #3992
- C-0236 policy updated to accept key-signed images without a transparency log entry, allowing opt-out for private registry deployments. Pull request #3967
- Release v4.0.15 published. Release
Why it matters
This week includes foundational infrastructure for Pod Security Standards evaluation alongside production container image scanning support for Quay registries. Critical bugs in caching, resource handling, and combined scan reporting were fixed, improving reliability and performance for large-scale deployments.
Changelog entry
- Pod Security Standards evaluation library added (Phase 1) Pull request #4003
- Red Hat Quay container image vulnerability adaptor implemented Pull request #3917
- Image scan report diffing added to kubescape diff Pull request #3957
- Interactive mode (-i/--interactive) for granular remediation in kubescape fix Pull request #3914
- Whole-cluster policy verify now fails closed on parity mismatches Pull request #4000
- O(N²) memory allocation eliminated in image scan target deduplication Pull request #3939
- File descriptor leak in partitionstore fixed Pull request #3988
- C-0236 policy accepts key-signed images without transparency log Pull request #3967
- Guard test added for go.mod replace directives Pull request #3992
- Container image vulnerability runs aggregated in combined SARIF scans Pull request #3946
- Scan cache bypass implemented for unencodable resources Pull request #3953
- Context cancellation respected in credential retry loop Pull request #3998
V4.0.15 ships Pod Security Standards evaluation, Quay registry scanning, image report diffing, interactive fix mode, and fixes for file descriptor leaks and O(N²) bottlenecks in image scanning.
Kubescape v4.0.15 is out. This release introduces Pod Security Standards evaluation for Kubernetes v1.31, production-grade Quay registry scanning, and the ability to diff image vulnerability reports. We also added interactive remediation mode, fixed critical resource leaks and performance bottlenecks in image scanning, and improved whole-cluster policy verification to fail safely on parity mismatches.
Week of September 21, 2026
What shipped
- Fleet scans now print a summary showing how each cluster performed and where they disagree, instead of requiring jq to parse JSON output. Pull request #3929
- Image signature verification now validates that the signed digest matches the image being verified, closing a gap where invalid signatures could be accepted. Pull request #3930
- SARIF and GitHub Actions output now report degraded scan coverage and skipped controls with their reasons. Pull request #3926
- Namespace filters can now be reloaded from a ConfigMap without restarting the Kubescape server. Pull request #3925
- Evidence resolution for resources rendered from Helm charts now works correctly and shows accurate line numbers. Pull request #3911
- The kubescape fix command now respects --output-dir for file-based reports instead of rewriting manifests in place. Pull request #3880
- Incremental scans no longer incorrectly reuse cached verdicts when a policy reads resource status through object.get. Pull request #3918
- Network policy analysis now correctly requires matching ports and protocols between source and destination for reachability. Pull request #3909
- RegoLibrary bumped to v2.0.36 to support signed checksum-manifest verification. Pull request #3893
- Port forwarder now times out after 30 seconds by default to prevent infinite hangs. Pull request #3873
Why it matters
This week addressed critical scan reliability issues in incremental caching, image verification, and fleet scanning. Fixes to incremental verdict reuse, network policy analysis, and report encryption ensure scans produce consistent and correct results. New features like fleet summaries and namespace filter reloading make the tool more operational.
Changelog entry
- Fleet scans print a summary after completion showing cluster status and fleet-wide results Pull request #3929
- Image signature verification validates signed digest matches the image through cosign claim verification Pull request #3930
- SARIF and GitHub Actions printers report degraded scan coverage and skipped controls with reasons Pull request #3926
- Namespace filters reload from KS_NAMESPACE_FILTERS_FILE without server restart Pull request #3925
- Incremental scans no longer reuse verdicts when policies read status through object.get Pull request #3918
- Incremental scans respect metadata.resourceVersion and metadata.managedFields changes Pull request #3919
- Helm chart resources now resolve evidence line numbers correctly Pull request #3911
- Network policy reachability analysis requires matching ports and protocols Pull request #3909
- Kubescape fix command respects --output-dir for file-based reports Pull request #3880
- Port forwarder adds 30-second timeout to prevent infinite hangs Pull request #3873
Kubescape improved scan reliability this week: fixed incremental cache reuse bugs, added fleet scan summaries, strengthened image signature verification, and enabled runtime namespace filter updates without restarts.
This week's Kubescape updates focus on reliability and operational improvements. Critical fixes prevent incremental scans from reusing verdicts incorrectly when policies read status fields or when scan context changes. Fleet scans now print human-readable summaries. Image signature verification now validates digest matching. Namespace filters reload at runtime. Network policy analysis correctly requires matching ports. These changes ensure scan results stay consistent and accurate across different contexts.
Week of September 14, 2026
What shipped
- Added --fleet-report flag to write a combined report across multiple --kube-contexts scans instead of separate reports per context. Pull request #3815
- Fleet reports now highlight which controls clusters disagree on, making it easier to spot divergence in a fleet. Pull request #3878
- Fleet reports now include a fleet-wide compliance rollup score instead of requiring manual calculation from per-cluster figures. Pull request #3852
- Introduced partition and spill store engine to bound memory usage during streaming resource collection on disk. Pull request #3818
- Wired partition store into streaming collector so resource batches no longer all accumulate in heap memory at once. Pull request #3863
- Image scanning now supports full Azure credential chain for ACR authentication including service principals, managed identity, and workload federation. Pull request #3853
- Updated embedded CEL admission-policy bundle from v0.14 to v0.15 with new Agent Runtime policies for Sandbox and Substrate resources. Pull request #3871
- Fleet reports are now written atomically to prevent corruption if a write fails partway through. Pull request #3849
- Added line number resolution for delete and review paths in --show-evidence output, completing coverage of all three remediation path types. Pull request #3830
- Fixed stalled pagination loops when Kubernetes API servers return the same continuation token multiple times. Pull request #3859
Why it matters
Fleet scanning now has dedicated reporting that shows agreement and disagreement across clusters at a glance, addressing a major pain point for multi-cluster operators. Memory efficiency improvements enable scanning very large clusters without unbounded heap growth. Image scanning gains better credential support and stricter vulnerability validation.
Changelog entry
- Add --fleet-report flag to generate a single combined report across multiple Kubernetes contexts Pull request #3815
- Fleet reports now identify which controls clusters disagree on Pull request #3878
- Fleet reports include fleet-wide compliance score rollup Pull request #3852
- Introduce partition and spill store engine for bounded memory in streaming collection Pull request #3818
- Integrate partition store into streaming collector to reduce heap pressure Pull request #3863
- Support Azure DefaultAzureCredential chain for ACR image authentication Pull request #3853
- Update CEL admission-policy bundle to v0.15 with Agent Runtime policies Pull request #3871
- Write fleet reports atomically to prevent corruption on write failures Pull request #3849
- Resolve line numbers for delete and review remediation paths in evidence output Pull request #3830
- Fix infinite pagination loops from duplicate Kubernetes API continuation tokens Pull request #3859
- Support nested Harbor repository paths in image scanning Pull request #3860
- Warn when incompatible flags combine with anonymized source paths in evidence Pull request #3830
- Skip evidence lines when source paths are anonymized Pull request #3830
- Persist workload scan report timestamps to spec.metadata.report.createdAt Pull request #3869
- Fix panic from negative nodeIndex values in location resolver Pull request #3874
- Fix misleading skip log and severity loop break in image processing Pull request #3848
- Restore fleet context after runner panic instead of leaving stale context Pull request #3856
- Stop printing usage text when patch severity threshold validation fails Pull request #3857
- Skip IaC scan tests when offline policies are missing to prevent CI failures Pull request #3806
Fleet scanning gets its first dedicated reports: see compliance rollup, control disagreement, and per-cluster findings in one file. Memory now bounded during large scans. Azure ACR auth chain and stricter CVE validation for images.
Kubescape fleet scanning now has dedicated multi-cluster reports showing fleet-wide compliance, which controls clusters disagree on, and per-cluster detail—no more opening individual files to compare. Streaming resource collection now bounds memory with partition storage. Image scans validate vulnerability freshness and unknown-severity CVEs. Azure Container Registry gains full credential chain support.