Insecure Cipher Suites in Kyverno TLS Endpoints by Nirmata
CVE-2023-54356

9.3CRITICAL

Key Information:

Vendor

Kyverno

Status
Kyverno
Vendor
CVE Published:
1 September 2026

What is CVE-2023-54356?

Versions of Kyverno up to 1.9.4 implement insecure 3DES cipher suites in their TLS endpoints, primarily TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA. This vulnerability exposes the product to potential attacks such as the Sweet32 attack (CVE-2016-2183), whereby attackers can exploit long-lived TLS connections with high traffic volumes to recover portions of plaintext. The issue has been addressed in versions 1.9.5 and 1.10.0, which help secure the product against this significant threat.

Affected Version(s)

kyverno 0 < 1.9.5, 1.10.0

kyverno 1.9.5, 1.10.0

References

https://github.com/kyverno/kyverno/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/kyverno-before-1.9.5...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.