Kubescape, the open-source Kubernetes security platform that checks your clusters against dozens of frameworks like NSA, MITRE ATT&CK, and CIS Benchmarks, just shipped v4.0.11 — and it is packed with new capabilities that go well beyond the usual bug-fix grind.
Think of Kubescape as a security auditor that never sleeps. It scans your live cluster, your Helm charts, your manifest files, and now your container images too — then tells you exactly where your configuration is leaking risk. You run it before production, in CI/CD pipelines, and as a continuous guardrail. Platform engineers, DevSecOps teams, and anyone responsible for cluster compliance rely on it to answer the eternal question: “Are we exposed?”
v4.0.11 is exciting because it adds container image vulnerability scanning, CEL-based policy execution, a beefed-up MCP server for programmatic scanning, and a pile of new output formats and integrations. Let us get into what matters.
Container Image Vulnerability Scanning Lands
This is the headline feature. Kubescape can now scan container images for known vulnerabilities, not just Kubernetes configuration. Two PRs make this happen:
First, the project introduced Container Image Vulnerability (CIV) Adaptor interfaces (#2482) — a pluggable architecture that lets Kubescape connect to different vulnerability databases and scanning engines. Think of it as a universal adapter: anyone can write a backend that feeds vulnerability data into Kubescape’s reporting pipeline.
Then, they shipped the first real backend: an AWS ECR vulnerability adaptor (#2488) that pulls vulnerability scans directly from Amazon ECR. If you are already running ECR’s built-in image scanning, Kubescape can now correlate those results with your Kubernetes configuration posture in a single report. That is a big deal for teams on AWS.
kubescape scan workload nginx-deployment/default --host-sensor --vulnerabilitiesOne tool for config drift and image vulnerabilities. That is the dream.
CEL Controls Run Inside Your Scans
Kubescape has historically used Rego (OPA’s policy language) for its control definitions. In v4.0.11, the project added the ability to run CEL (Common Expression Language) controls as part of the scan (#2525). CEL is the same expression language Kubernetes uses for admission policies, validation rules, and CRD schema checks.
Why does this matter? Because CEL is significantly faster to evaluate than Rego for simple rule checks, and it is the direction Kubernetes itself is moving with Validating Admission Policies (VAP). Speaking of which, Kubescape now also vendors and embeds the CEL admission policy bundle (#2455, #2474, #2485) — meaning it can validate your cluster against the same CEL policies the API server enforces at admission time.
As a performance bonus, compiled CEL programs are now cached across scanned objects (#2503), so scanning 1,000 resources does not mean recompiling the same policy 1,000 times.
kubescape scan --enable-host-scan --use-artifacts-from noneMCP Server Gets Headless Scanners
Kubescape ships an MCP (Model Context Protocol) server that lets AI agents and automation tools query your cluster’s security posture programmatically. v4.0.11 makes it dramatically more capable:
- Headless RBAC scanner (#2492) — The MCP server can now analyze RBAC permissions without spinning up a full scan pipeline. This means lower latency when an AI agent asks “who can do what in this namespace?”
- Headless Network Policy scanner (#2512) — Same idea, but for network policies. Query your network exposure without a full cluster scan.
- Container profile tools (#2479) — The MCP server can now inspect container security profiles (seccomp, AppArmor, capabilities) as first-class resources.
If you are building AI-powered security tooling on top of Kubernetes, these headless scanners give your agents fast, targeted access to the specific data they need without the overhead of a monolithic scan.
New Output Formats and Integrations
- GitLab SAST report format (#2505) — Kubescape can now emit reports in GitLab’s native SAST JSON format. If your CI runs on GitLab, you can pipe Kubescape results directly into merge request security widgets. No glue code required.
- OCI and local patch exports (#2471) — Patch reports (the remediation fixes Kubescape generates) can now be exported to OCI registries or local files. This makes it trivial to distribute fixes across teams or feed them into GitOps pipelines.
- Quarantine remediation action (#2461) — The
remediateCLI subcommand now supports aquarantineaction, letting you automatically isolate compromised workloads instead of just deleting them.
Report Protection and Privacy
For teams that need to share security reports externally without exposing sensitive cluster metadata, v4.0.11 adds two important capabilities:
- Reversible container metadata anonymization (#2473) — You can now anonymize container metadata in reports and reverse it later when you need to. Previously anonymization was a one-way trip.
- Encrypted report decryption (#2493) — Reports with encrypted resource metadata can now be decrypted, completing the round-trip for teams using Kubescape’s report encryption feature.
Bug Fixes and Stability
v4.0.11 includes 17 bug fixes improving scan reliability, SARIF output, air-gapped mode, Helm template handling, and HTTP handler robustness. Notable fixes include resolving scan invocation issues (#2530), preventing empty SARIF files (#2499), and fixing air-gapped mode detection (#2458).
One sentence: Kubescape v4.0.11 is the release where it stops being just a configuration scanner and starts being a full Kubernetes security platform — image vulnerabilities, CEL policies, MCP-powered AI integrations, and GitOps-friendly outputs included.
