kubescape

No entries match these filters. Clear filters

1. v4.0.17 Oct 28, 2026 · issue 124

   Kubescape adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server tools, fleet config file support, graded fleet exit codes, webhook notifications for image scans, and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal./EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. in image scan output⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.17 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.17

   └──▷ TRY IT
   Trigger a webhook after scanning an image so a downstream system receives the vulnerability results automatically.
   copy

   $ kubescape scan image nginx:latest --notify https://hooks.example.com/kubescape

   Pipe a local manifest into the predict subcommand from stdin instead of passing a file path — useful in CI pipelines where the manifest is generated on the fly.
   copy

   $ helm template my-release ./chart | kubescape predict -

   • Read fleet settings from a config file with feat(fleet): read fleet settings from a config file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add --notify webhook support for image scans with --notify
   • Improves MCP server tools: adds an include_identity parameter to analyze_vulnerability_exposure, adds filtering and pagination to list_vulnerabilities_in_manifest, adds control filtering to get_configuration_security_scan_manifest, filters list_controls by framework, paginates list_controls responses, and counts unchanged findings in diff_reports while listing them only on request.
   • Adds create_admission_policy_binding, list_configuration_security_scan_summaries, list_sboms, list_sbom_packages, and validate_scan_selection (with shared control resolution) tools to the MCP server.
   • Apply remediation for report items from posture reports via MCP

   +5 more show less

   • Emit graded exit codes for fleet runs
   • Show CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. and EPSS scores in image scan output
   • Keep exception audit trail in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. results
   • Evaluate Gateway API ReferenceGrant objects for cross-namespace backends in exposure analysis
   • Adds an --output-post-renderer flag to the fix command for Helm, hardens overlay staging and boundaries, and renders Helm charts for the newest Kubernetes version their kubeVersion allows.
   • Read fleet settings from a config file with feat(fleet): read fleet settings from a config file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add --notify webhook support for image scans with --notify
   • Adds create_admission_policy_binding, list_configuration_security_scan_summaries, list_sboms, list_sbom_packages, and validate_scan_selection (with shared control resolution) tools to the MCP server.
   • Apply remediation for report items from posture reports via MCP
   • Show CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. and EPSS scores in image scan output

   5 more in Everything

2. v4.0.16 Oct 14, 2026 · issue 109

   Adds PSS compliance prediction CLI and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, interactive fix mode, image scan diff, attack-path SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. fields, and Helm rendering version flags.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.16 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.16

   • Adds --kube-version and --api-versions flags to kubescape scan for accurate Helm chart rendering against a specific Kubernetes API surface.
   • Adds --interactive mode to kubescape fix for granular, step-by-step remediation of misconfigurations.
   • Adds kubescape diff subcommand to compare image scan reports and surface newly introduced and resolved vulnerabilities.
   • Adds list_admission_policies tool to the MCP server, exposing admission policy enumeration to AI assistants.
   • Adds diff_reports tool to the MCP server for scan report comparison via AI assistant integration.

   +8 more show less

   • Adds predict subcommand with a Pod Security Standards (PSS) compliance predictor CLI.
   • Adds PSS compliance prediction tool to the MCP server.
   • Adds secret exposure detection tool to the MCP server.
   • Surfaces attack-path priority score and severity in SARIF result properties output.
   • Includes skipped and unevaluated controls in JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. report output.
   • Reports scan coverage and skipped-control diagnostics in PDF output.
   • Accounts for external exposure when analysing vulnerability risk in image scans.
   • Retries clusters whose API server never answered during fleet scans.

   13 details in Everything

   • New integration Red Hat Quay vulnerability adaptor
3. v4.0.15 Sep 29, 2026 · issue 089

   Kubescape v4.0.15 adds multi-cluster fleet scanning, Quay image scanning, namespace-filter hot-reload, and scan-coverage metrics in reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.15 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.15

   └──▷ TRY IT
   Scan multiple Kubernetes clusters in one pass and write a unified fleet report — useful in multi-tenant or multi-region environments.
   copy

   $ kubescape scan --kube-contexts prod-us,prod-eu,staging --fleet-report fleet-results.json

   • Adds --fleet-report flag to kubescape scan to write one combined report across multiple clusters specified with --kube-contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --show-evidence output that now resolves fix-path line numbers for delete and review paths.
   • Adds kubescape config view support for filtering configurations by key.
   • Adds support for deleting specific configuration keys via kubescape config.
   • Adds --output-dir support honoured for file-based reports.

   +13 more show less

   • Adds Quay vulnerability scanning support for image scans.
   • Adds full Azure credential chain support for ACR image pulls in image scanning.
   • Adds scan coverage metrics to Markdown, HTML, and CSV report outputs.
   • Adds reporting of degraded scan coverage and skipped controls in printer output.
   • Adds compliance rollup to the fleet report.
   • Adds a fleet summary printed after a multi-context scan.
   • Adds reporting of controls that clusters disagree on in fleet scans.
   • Adds hot-reload of namespace filters in the HTTP handler without requiring a restart.
   • Adds complete Agent Runtime policy set to VAP (kubescape vap).
   • Introduces partition and spill store engine for large-cluster resource handling.
   • Uses mmap and fastjson for manifest parsing, improving performance on large manifest sets.
   • Adds support for key-signed images without a transparency log entry in control C-0236.
   • Adds execution policies for whole-cluster controls in the OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. processor.
   • Adds --fleet-report flag to kubescape scan to write one combined report across multiple clusters specified with --kube-contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Quay vulnerability scanning support for image scans.
   • Introduces partition and spill store engine for large-cluster resource handling.
   • Adds execution policies for whole-cluster controls in the OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. processor.

   14 more in Everything

4. v4.0.14 Sep 9, 2026 · issue 069

   Kubescape v4.0.14 adds fleet-wide multi-cluster scanning, --framework/--search filters for list controls, and structured MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. error responses.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.14 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.14

   └──▷ TRY IT
   Filter the control list to a specific framework to quickly find controls relevant to a compliance standard.
   copy

   $ kubescape list controls --framework nsa

   Run a framework scan across multiple clusters simultaneously in fleet mode to get a cross-cluster posture view.
   copy

   $ kubescape scan framework nsa --kube-contexts cluster-prod,cluster-staging,cluster-dev

   • Adds --framework and --search filters to kubescape list controls to narrow the control listing by framework or keyword.
   • Extends --kube-contexts fleet mode in kubescape scan to support framework, control, and workload scan targets across multiple clusters.
   • Adds cross-cluster control matrix and fleet report types for fleet-wide posture aggregation.
   • Introduces structured, machine-readable error responses in the kubescape mcpserver MCP server.
   • Adds host-users-root-workload-v1 detection rule to identify workloads running as host root users.

   +1 more show less

   • Extends the provider-iam-assumption-v1 rule to detect Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Workload Identity.
   • Adds cross-cluster control matrix and fleet report types for fleet-wide posture aggregation.
   • Adds host-users-root-workload-v1 detection rule to identify workloads running as host root users.

   4 more in Everything

5. v4.0.13 Sep 2, 2026 · issue 062

   Kubescape v4.0.13 adds custom RegoRegoA declarative policy language created by the Open Policy Agent project, used to express authorization and compliance rules as code so cyber tools can evaluate structured data against those rules consistently. rules, offline image scanning, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. surfacing, new RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. controls, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, and fix/list/config improvements.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.13 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.13

   └──▷ TRY IT
   Scan a container image for vulnerabilities in an air-gapped environment without updating the vulnerability DB.
   copy

   $ kubescape scan image myregistry.local/myapp:v1.2.3 --skip-db-update

   Auto-remediate only specific controls to limit the blast radius of a fix run.
   copy

   $ kubescape fix --include-controls C-0016,C-0044 /path/to/manifests/

   • Adds --custom-rules flag to load user-authored Rego rules from the standard rule directory layout during scans.
   • Adds --skip-db-update flag to kubescape scan image for fully offline/air-gapped image vulnerability scanning.
   • Adds --include-controls and --skip-controls flags to kubescape fix to select which controls get remediated.
   • Adds --format / -f flag to kubescape config view to control output format.
   • Adds scan_controls, scan_local_iac_controls, list_frameworks, and list_controls tools to the MCP server for AI assistant integration.

   +17 more show less

   • Extends kubescape fix to support cluster scan reports by printing patched manifests (previously only file-based manifests were supported).
   • Enables kubescape fix to apply fixes to JSON manifests (in addition to YAML).
   • New control C-0298 detects RBAC subjects that can attach ephemeral containers to pods.
   • Adds RBAC-police rules covering impersonate, token-mint, escalate, bind, node-proxy, and PV create privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths.
   • Surfaces VEX (Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.) status in image scan reports.
   • Adds native GitLab vulnerability adaptor for image scanning output.
   • Adds native Harbor vulnerability adaptor for image scanning output.
   • Adds multi-arch image support: scans the correct platform for multi-arch images.
   • Adds MutatingAdmissionPolicy discovery and impact matching to the admission-policy map reconciler.
   • Models external exposure via Ingress, Gateway API, and Service type, plus spec.externalIPs, in the exposure engine.
   • Evaluates VAP matchConditions offline instead of refusing the control, and honors spec.failurePolicy for validation expression errors.
   • Adds opt-in audit logging for posture exceptions.
   • Adds filter support to kubescape list controls — filter by framework and search term.
   • Adds display of the control configuration a scan evaluates against to kubescape list.
   • Adds aggregate summary outputs to kubescape diff.
   • Flags frameworks scored 100% purely from irrelevant controls and reports resource kinds that no control examined, improving coverage transparency.
   • Adds URL context to repository scanner error messages for easier diagnosis.

   22 details in Everything

6. docs update Aug 28, 2026 · issue 058

   Kubescape adds vulnerability exceptions to SecurityException CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., letting teams suppress CVE findings per-image using VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.-compatible statuses.

   └──▷ USE IT
   Suppress an unreachable CVE on all nginx tags in the production namespace so it no longer appears in reported findings.
   except-cve-2023-45853.yaml copy

   apiVersion: kubescape.io/v1beta1
   kind: SecurityException
   metadata:
     name: except-cve-2023-45853
     namespace: production
   spec:
     reason: 'zlib is present but the vulnerable path is never called'
     author: 'platform-team'
     match:
       images:
         - 'docker.io/library/nginx:*'
     vulnerabilities:
       - vulnerability:
           id: CVE-2023-45853
         status: not_affected
         justification: vulnerable_code_not_present

   Enable vulnerability exception processing in the Kubescape operator so SecurityException resources are actually honoured by kubevuln.
   copy

   $ helm upgrade kubescape kubescape/kubescape-operator --reuse-values --set capabilities.riskAcceptance=enable

   Scope a CVE exception to a specific Debian package version and auto-expire it once a fix is published, limiting blast radius and preventing stale suppression.
   except-cve-2023-45853-zlib.yaml copy

   apiVersion: kubescape.io/v1beta1
   kind: SecurityException
   metadata:
     name: except-cve-2023-45853-zlib
     namespace: production
   spec:
     expiresAt: '2026-12-31T00:00:00Z'
     match:
       images:
         - 'docker.io/library/nginx:*'
     vulnerabilities:
       - vulnerability:
           id: CVE-2023-45853
         status: not_affected
         justification: vulnerable_code_not_present
         expiredOnFix: true
         expiresAt: '2026-09-30T00:00:00Z'
         subcomponents:
           - 'pkg:deb/debian/zlib1g@1:1.2.13.dfsg-1'

   • Enables vulnerability exceptions via the Helm value capabilities.riskAcceptance=enable (defaults to disable); without it, matching resources are silently ignored with only a startup warning.
   • Supports VEX-compatible status values — not_affected, fixed, affected, under_investigation — to control whether a CVE finding is suppressed or kept visible with extra context.
   • Adds vulnerability.id (required CVE ID) and vulnerability.aliases (alternate IDs) fields under spec.vulnerabilities[] to identify which CVE an entry targets.
   • Adds justification field (e.g. vulnerable_code_not_present) and impactStatement free-text alternative for not_affected entries.
   • Adds actionStatement and response fields (values: can_not_fix, will_not_fix, update, rollback, workaround_available) for affected entries; suppression under affected requires both fields with a fully non-remediating response.

   +6 more show less

   • Adds subcomponents field accepting PURLs to scope an exception to specific packages within a matched image rather than the whole image.
   • Adds expiredOnFix boolean field that automatically stops suppressing a CVE once a fix becomes known, preventing stale exceptions from hiding newly actionable findings.
   • Adds per-entry expiresAt (RFC 3339 timestamp) field under spec.vulnerabilities[], overriding the resource-level spec.expiresAt for that entry only.
   • Adds image-glob matching via spec.match.images[] using path.Match semantics (* does not cross /), with Docker Hub normalisation so nginx:1.25, library/nginx:1.25, docker.io/nginx:1.25, and index.docker.io/library/nginx:1.25 all resolve to the same image.
   • Records each suppression as a VulnerabilitySuppressed Event on the triggering resource, auditable via kubectl describe securityexception <name>; suppressed CVEs move to the ignored list on the VulnerabilityManifest rather than being dropped.
   • Integrates with VEX document generation: when VEX output is enabled, suppressed CVEs appear as statements in the published VEX document carrying their status, justification, and action statement.

   11 details in Everything

7. v4.0.12 Aug 12, 2026 · issue 043

   Kubescape v4.0.12 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server tools, new scan flags, Terraform scanning, cloud registry adaptors, markdown output, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.12 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.12

   • Adds DELETE /v1/scan API endpoint to cancel an in-flight scan.
   • Adds --api-version flag to the workload scan command to specify the API version of the scanned resource.
   • Adds --label-selector flag to filter collected resources during a scan.
   • Adds --only-fixable flag to gate scan image severity threshold on fix availability.
   • Adds --output json flag to the version command for machine-readable version info.

   +28 more show less

   • Adds markdown output format to the scan printer (alongside existing JSON, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., HTML, CSV, etc.).
   • Adds csv output format to the list command.
   • Adds yaml output format to the list command.
   • Adds configurable output formats to config view.
   • Adds CSV output format with remediation path evidence columns to scan results.
   • Supports all output formats for image scans (aligning patch and scan image output options).
   • Supports scanning local offline tarball images with kubescape scan image.
   • Adds scan_container_image MCP server tool for on-demand container image vulnerability scanning.
   • Adds a headless framework security scanner MCP tool via kubescape mcpserver.
   • Adds a local IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanner MCP tool via kubescape mcpserver.
   • Adds scanning of kubernetes_manifest and typed kubernetes_* resources in Terraform files.
   • Introduces a native GCP Artifact Registry vulnerability adaptor (Container Image Vulnerability, Phase 2).
   • Introduces a Container Image Vulnerability (CIV) adaptor for Azure Container Registry.
   • Adds Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. support to ListEntitiesForPolicies resource mapping.
   • Implements Runtime Profile Drift Detection and Remediation (KS-ADV-01).
   • Implements a concurrent and deduplicated image scan pipeline (KS-ADV-02) to improve throughput.
   • Adds automated in-cluster private registry credential resolver for image scans.
   • Adds fallback support for OpenShift external registry routes.
   • Adds support for scoped registry auth for image scans.
   • Adds resource streaming for large clusters (feat(streaming)) to reduce memory usage during scans.
   • Optimizes host-sensor queries with paging, rate limits, and caching.
   • Supports configurable workload kinds and dynamic pod template spec detection in resource prioritization.
   • Surfaces current field values alongside failed paths in scan output (HTML and printer).
   • CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. findings now carry the same remediation paths as their Rego equivalents.
   • Cloud exceptions are now preferred over CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. exceptions (feat(exceptions)).
   • Switches Rego evaluation to RegoV1, dropping the v0 compatibility shim.
   • Unifies scan stdin input handling for consistent behavior across scan commands.
   • Adds ParseDurationEnvVar for duration-based environment variable configuration.

   33 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Rego policies are now evaluated with RegoV1 only — the v0 compatibility shim has been removed. Policies relying on v0 Rego syntax will break.
8. v4.0.11 Jul 22, 2026 · issue 041

   Kubescape v4.0.11 adds GitLab SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. output, quarantine remediation, AWS ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. vuln adaptor, CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. controls scanning, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./local patch exports

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.11 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.11

   • Adds gitlab-sastgitlab-sastGitLab's built-in static analysis feature that scans source code for vulnerabilities during CI/CD pipelines, letting cyber tools integrate findings directly into merge-request workflows without external scanners. as a new --format output option via feat(printer): add GitLab SAST report output format, enabling native GitLab Security Dashboard integration.
   • Adds quarantine action to the kubescape operator remediate CLI subcommand for isolating non-compliant workloads.
   • Adds OCI and local export targets to kubescape patch, expanding patched image delivery options beyond remote registries.
   • Runs CEL-based admission controls as part of kubescape scan, bundling and evaluating the VAP CEL policy suite without a network call.
   • Implements an AWS ECR vulnerability adaptor via the new Container Image Vulnerability (CIV) Adaptor interface, enabling ECR-native image vulnerability data ingestion.

   +7 more show less

   • Adds decryption support for encrypted resource metadata (report crypto), complementing the existing encryption path.
   • Adds headless OPAProcessor for low-latency Network Policy scanning in the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.
   • Adds headless OPAProcessor RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. scanner to the MCP server.
   • Adds container profile tools and resources to the MCP server.
   • Supports reversible container metadata transformation in the anonymizer (feat(anonymizer): support reversible container metadata transformation).
   • Honors objectSelector.matchExpressions in PostureExceptionPolicy.ObjectSelector, enabling expression-based exception scoping.
   • The vap deploy-library subcommand now serves the embedded VAP bundle by default; network download only occurs when --from-release is passed.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The vap deploy-library subcommand no longer downloads the VAP bundle from the network by default — it serves the embedded bundle instead. Pass --from-release to restore the previous download behaviour.
9. v4.0.10 Jun 30, 2026 · release notes

   kubescape v4.0.10 adds operator remediate CLI subcommand for dry-run annotate operations

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.10 https://github.com/kubescape/kubescape.git
   # already have the repo? check out this version:
   $ git checkout v4.0.10

   └──▷ USE IT
   Preview remediation annotations for all Kubernetes resources in the current namespace without applying them.
   shell copy

   kubescape operator remediate --dry-run

   • Adds the operator remediate CLI subcommand to annotate resources with remediation suggestions (dry-run only).
   • Emit the security-severity field in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. rule outputs.
   • Add per-control evaluation timeout capability for the OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. processor.

   3 details in Everything

10. v4.0.9 May 29, 2026 · release notes

    kubescape v4.0.9 adds SecurityException event emission, VAP enforcement reconcile, and failure surface for partial GVR collections

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.9 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v4.0.9

    • SecurityException events are now emitted when posture exception matches occur, allowing downstream auditing of exceptional posture states.
    • Partial Group/Version/Resource (GVR) collection failures are surfaced instead of being silently suppressed, enabling visibility into scanning gaps.

    2 details in Everything

11. v4.0.8 May 8, 2026 · release notes

    Adds --timeout flag to kubescape deploy-library command to control deployment wait time.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.8 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v4.0.8

    └──▷ TRY IT
    Limit the time to wait for cloud library deployment when using slow or unstable connections.
    copy

    $ kubescape deploy-library --timeout=5m

12. v4.0.7 May 8, 2026 · release notes

    kubescape v4.0.7 adds ControlInput CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., TLS env var support, and expired exception filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.7 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v4.0.7

    └──▷ TRY IT
    Run kubescape with custom TLS certificates for the local HTTP handler using environment variables.
    copy

    $ KUBESCAPE_TLS_KEY=/path/to/key.pem KUBESCAPE_TLS_CERT=/path/to/cert.pem kubescape scan cluster

    • Adds ControlInput CRD for in-cluster control configuration via kubectl apply.
    • Enables TLS key configuration for the HTTP handler using KUBESCAPE_TLS_KEY and KUBESCAPE_TLS_CERT environment variables.
    • Filters expired exceptions from results before they are applied during scanning.

    3 details in Everything

13. v4.0.6 May 4, 2026 · release notes

    Adds --helm-values-overrides to kubescape scan for custom Helm values and enables Kustomize-Helm rendering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.6 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v4.0.6

    • --helm-values-overrides flag on kubescape scan accepts a JSON string of Helm values to override during local cluster scans
    • Enables automatic detection and rendering of Kustomize directories that include helmCharts blocks, allowing mixed manifests to be scanned without manual conversion

    2 details in Everything

14. v4.0.3 Mar 17, 2026 · release notes

    kubescape v4.0.3 adds the --grype-db-url flag to override the Grype database URL for container image scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.3 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v4.0.3

    └──▷ TRY IT
    Scan an image using a custom or on-premise Grype database source.
    copy

    $ kubescape scan image my-image --grype-db-url http://internal-registry/grype/db

15. v4.0.0 Feb 4, 2026 · release notes

    kubescape v4.0.0 introduces a krew plugin manifest, a verbose flag for scan-images, and an image column in vulnerability table output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    └──▷ USE IT
    Run a vulnerability scan on container images with detailed logging enabled via the new verbose flag.
    shell copy

    kubescape scan-images --verbose --images my-app:v1

    • Adds --verbose flag to the scan-images command to show detailed output
    • Adds an image column to the vulnerability scanning table output

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Replaces the host sensor with a node agent for cluster sensing, changing the underlying component used for host-level data collection.
16. v3.0.48 Jan 22, 2026 · release notes

    Adds --labels-to-copy flag to copy workload labels into scan reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.48 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.48

    └──▷ USE IT
    Include specific Kubernetes resource labels in the scan output for traceability.
    shell copy

    kubescape scan --labels-to-copy app,version

17. v3.0.47 Dec 15, 2025 · release notes

    kubescape v3.0.47 adds --skip-persistence flag and debug listing with adjusted JUnit report options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.47 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.47

    • Adds --skip-persistence CLI flag to skip persistence-related scanning logic
    • Adds debug listing capability for enhanced troubleshooting visibility
    • Adjusts JUnit report output options to improve CI/CD integration flexibility

    3 details in Everything

18. v3.0.46 Dec 5, 2025 · release notes

    kubescape v3.0.46 adds severity field to JSON output and fixes metrics export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.46 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.46

    └──▷ TRY IT
    Extract severity levels from scan results for automated reporting.
    copy

    $ kubescape scan api --format json | jq '.controls[] | select(.severity != null) | .id + ": " + .severity'

    • Adds the severity field to controls in JSON output for granular result inspection

    1 detail in Everything

19. v3.0.40 Sep 2, 2025 · release notes

    kubescape v3.0.40 adds default matchers for image scanning and fixes remediation display

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.40 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.40

    └──▷ TRY IT
    Scan an image using default matchers for exceptions.
    copy

    $ kubescape scan image <image-name> --default-matchers

    • Adds --default-matchers flag to image scanning commands to apply matcher defaults
    • Improves Assisted Remediation output to include the container name in the results

    2 details in Everything

20. v3.0.35 Jul 7, 2025 · release notes

    Adds mcpserver subcommand to expose Kubescape capabilities via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.35 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.35

    • Adds mcpserver subcommand to start an Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for tool integration

    1 detail in Everything

21. v3.0.33 Mar 24, 2025 · release notes

    kubescape v3.0.33 adds review-values support to the prerequisites UI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.33 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.33

    • Enhances the prerequisites UI with new review-values functionality and improved PR handling

    1 detail in Everything

22. v3.0.27 Feb 11, 2025 · release notes

    kubescape v3.0.27 adds the --exceptions flag to the scan image CLI command and exception rule support in the Scan API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.27 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.27

    • Adds --exceptions flag to the scan image subcommand to exclude specific findings during container image scanning
    • Extends the Scan API to accept exception rules via HTTP request body, allowing programmatic exclusion of findings

    2 details in Everything

23. v3.0.23 Jan 9, 2025 · release notes

    Adds airgap support and trigger-by-indication in posture reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.23 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.23

    • Introduces airgap support for offline scanning scenarios
    • Adds trigger by indication in posture report output

    2 details in Everything

24. v3.0.22 Dec 11, 2024 · release notes

    Adds capability to print rego policy print statements for debugging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.22 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.22

25. v3.0.12 Jul 3, 2024 · release notes

    Adds helper functions for VAP and CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. admission library

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.12 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.12

    • AddVapHelper and AddCelHelper in the VAP/CEL admission library

    1 detail in Everything

26. v3.0.9 May 1, 2024 · release notes

    kubescape v3.0.9 now includes control IDs in PDF reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.9 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.9

    • Adds control id to pdf output

    1 detail in Everything

27. v3.0.5 Mar 13, 2024 · release notes

    Adds riscv build target and environment variables BuildNumber, Client for self-hosted gitlab support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.5 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.5

    └──▷ TRY IT
    Inject self-hosted gitlab identity into kubescape reports via environment variables.
    copy

    $ export BuildNumber="abc123" && export Client="my-gitlab-instance" && ./kubescape scan cluster

    • Adds a riscv build target to the release assets, enabling installation on RISC-V architectures.
    • Reads the new BuildNumber and Client environment variables to populate scan metadata.

    2 details in Everything

28. v3.0.4 Mar 1, 2024 · release notes

    kubescape v3.0.4 adds debugging for Helm chart scanning and vulnerability details to scan summaries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.4 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.4

    • Adds debugging ability for scanning Helm charts
    • Includes Vulnerability scanning report in the summaryDetails section

    2 details in Everything

29. v3.0.1 Nov 1, 2023 · release notes

    Kubescape v3.0 adds image vulnerability scanning, experimental patching, and operator-triggered scans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.1 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.1

    └──▷ USE IT
    Scan a container image for known vulnerabilities before deployment.
    shell copy

    kubescape scan image nginx

    Trigger a configuration audit through the Kubescape-Operator for cluster resources.
    shell copy

    kubescape operator scan configurations

    • Adds kubescape scan image command to scan container images for potential vulnerabilities
    • Adds kubescape patch image command (experimental) to reduce vulnerabilities in container images
    • Adds kubescape operator scan configurations subcommand to trigger configuration scans via the Kubescape-Operator
    • Adds kubescape operator scan vulnerabilities subcommand to trigger vulnerability scans via the Kubescape-Operator

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Kubescape is now independent from ARMO Platform and removes all direct or indirect dependencies on it.
30. v3.0.0 Oct 22, 2023 · release notes

    Kubescape v3 introduces scan image, patch image, and operator scan subcommands for container security.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    └──▷ USE IT
    Scan a container image for known vulnerabilities.
    shell copy

    kubescape scan image nginx

    Trigger an operator-driven scan of cluster configurations.
    shell copy

    kubescape operator scan configurations

    Trigger an operator-driven scan for image vulnerabilities across the cluster.
    shell copy

    kubescape operator scan vulnerabilities

    • Adds the kubescape scan image <image> CLI subcommand to scan container images for vulnerabilities
    • Adds the experimental kubescape patch image <image> CLI subcommand to patch vulnerabilities in container images
    • Adds kubescape operator scan configurations and kubescape operator scan vulnerabilities CLI subcommands to trigger scans via the Kubescape-Operator

    3 details in Everything

31. v2.1.2 Feb 6, 2023 · release notes

    kubescape v2.1.2 adds cosign signature checking, OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces, and upgrades default JSON output to v2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.2 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.1.2

    └──▷ USE IT
    Verify a container image's signature using cosign before scanning it with kubescape
    shell copy

    kubescape scan container --image <image_name> --cosign-enabled=true

    Enable OTEL tracing to send metrics to an Uptrace collector for debugging scan performance
    shell copy

    kubescape scan cluster --otel-endpoint http://localhost:4317 --otel-service-name kubescape-scan

    • Adds cosign functions for container image signature verification during scanning
    • Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. (OTEL) tracing via the Uptrace client for observability
    • Changes default JSON output format to v2 across all CLI commands

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default JSON output format is now v2 instead of the previous version; scripts relying on the old schema may break.
32. v2.0.183 Jan 13, 2023 · release notes

    kubescape v2.0.183 adds kubescape fix, Azure and Bitbucket remote scanning, and a --create-account flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.183 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.183

    └──▷ USE IT
    Remediate issues from a previous scan results file using the new fix command.
    shell copy

    kubescape fix results.json

    Scan a Bitbucket remote repository directly.
    shell copy

    kubescape scan git@bitbucket.org:<user>/<repo>.git

    • Support for scanning Azure remote repositories in kubescape scan
    • Support for scanning Bitbucket repositories in kubescape scan
    • New --create-account flag to submit data to the ARMO platform without pre-registration

    3 details in Everything

33. v2.0.180 Jan 3, 2023 · release notes

    Alpha support for prioritizing failed resources by attack vector via --print-attack-tree

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.180 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.180

    └──▷ TRY IT
    Run a scan and output the attack tree to visualize risk prioritization of failed checks
    copy

    $ kubescape scan --print-attack-tree

34. v2.0.179 Dec 22, 2022 · release notes

    Adds GitLab remote repository scanning and multi-format/multiple-file output to kubescape scan

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.179 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.179

    └──▷ TRY IT
    Authenticate to a private gitlab repository by setting the required environment variable before scanning.
    copy

    $ export GITLAB_TOKEN='your_private_token'; kubescape scan https://gitlab.com/private/repo.git

    • Allows specifying the GITLAB_TOKEN environment variable to authenticate scanning of private gitlab repositories

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !kubescape scan control now requires control IDs instead of control names; scanning by name is deprecated and will stop working.
35. v2.0.175 Nov 6, 2022 · release notes

    kubescape v2.0.175 adds kubescape update command and GCP registry support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.175 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.175

    └──▷ TRY IT
    Update the kubescape binary to the latest version directly from the CLI.
    copy

    $ kubescape update

    • Adds kubescape update command for updating the Kubescape binary (beta)
    • Supports GCP image registry integration

    2 details in Everything

36. v2.0.171 Sep 19, 2022 · release notes

    v2.0.171 adds --cluster-name CLI flag and severity-based fail thresholds for CI gating

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.171 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.171

    └──▷ TRY IT
    Use this when running Kubescape in CI to assign a custom identifier to the scan results for traceability across multiple clusters.
    copy

    $ kubescape scan --cluster-name=my-production-cluster

    • Adds --cluster-name=<name> flag to the Kubescape CLI to manually specify the cluster name for scanning reports
    • Adds option to fail the Kubescape process based on the number of severities found, enabling stricter CI gate criteria

    2 details in Everything

37. v2.0.160 Jun 30, 2022 · release notes

    New repository scanning capability and HTML output format for kubescape

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.160 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.160

    └──▷ TRY IT
    Export findings in HTML format for sharing with non-technical stakeholders.
    copy

    $ kubescape scan framework cis-1.5 --format html > report.html

    • Adds html to the list of supported output formats
    • Adds -v flag to install.sh to specify a release version

    2 details in Everything

38. v2.0.159 Jun 30, 2022 · release notes

    kubescape v2.0.159 adds repository scanning support and HTML output format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.159 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.159

    └──▷ USE IT
    Install exactly version v2.0.158 of the cyber tool to match a specific dependency or policy requirement.
    shell copy

    ./install.sh -v v2.0.158

    • ./install.sh -v <version> now accepts a specific version argument to install that exact release instead of the latest
    • Adds --format html (implied by new output support) to export scan results as an HTML file for sharing with non-technical stakeholders

    2 details in Everything

39. v2.0.152 Apr 11, 2022 · release notes

    kubescape v2.0.152 adds GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. support, Prometheus integration (beta), severity column, and CLI output updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.152 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.152

    └──▷ HOW TO FIND IT
    Enable Prometheus metrics scraping for kubescape's HTTP handler service.
    📍Refer to httphandler/examples/prometheus for configuration details.
    • Adds GKE support for scanning Google Kubernetes Engine clusters
    • Adds prometheus (beta support) via the HTTP handler example at httphandler/examples/prometheus

    2 details in Everything

40. v2.0.149 Mar 6, 2022 · release notes

    Adds --format-version for JSON v2, PDF output, host scanner YAML customization, and autocompletion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.149 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.149

    └──▷ USE IT
    Export scan results in the new v2 JSON format for downstream processing.
    shell copy

    kubescape scan cluster --format-version 2 > output.json

    Generate a PDF report of the scan findings.
    shell copy

    kubescape scan cluster --format pdf > report.pdf

    Deploy a custom host scanner DaemonSet by providing a modified YAML spec.
    shell copy

    kubescape scan cluster --host-scan-yaml ./custom-daemonset.yaml

    • Adds --format-version flag to support Format v2 (JSON, pretty-printer) output
    • Adds PDF support for scan results export
    • Adds autocompletion support for shells
    • Adds --host-scan-yaml flag to customize the host scanner DaemonSet

    4 details in Everything

41. v2.0.148 Feb 20, 2022 · release notes

    kubescape v2.0.148 adds KS_LOGGER_NAME and --cache-dir

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.148 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v2.0.148

    └──▷ USE IT
    Configure kubescape to use the zap logging backend for structured log output.
    shell copy

    export KS_LOGGER_NAME=zap
    kubescape scan

    Store and read kubescape's cache in a custom directory to avoid defaults.
    shell copy

    export KS_CACHE_DIR=/tmp/kubescape-cache
    kubescape scan

    • Support zap logger via KS_LOGGER_NAME environment variable
    • Specify cache directory location using --cache-dir flag or KS_CACHE_DIR env var

    2 details in Everything

42. v1.0.136 Dec 22, 2021 · release notes

    Adds host-sensor controls support to Kubescape scanning capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.136 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v1.0.136

    • Supports host-sensor controls in scan operations
    • Supports cloud configurations controls in scan operations
    • Results now include URLs for control details

    3 details in Everything

43. v1.0.133 Dec 12, 2021 · release notes

    Adds --verbose flag to kubescape CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.133 https://github.com/kubescape/kubescape.git
    # already have the repo? check out this version:
    $ git checkout v1.0.133

    └──▷ USE IT
    Enable verbose logging to see detailed scanning progress and diagnostics.
    shell copy

    kubescape scan --verbose

    • --verbose flag available for detailed output in the CLI

    1 detail in Everything