Download Latest Version kubescape_4.0.17_windows_amd64.exe (298.4 MB) Google Add to Preferred Sources
Home / v4.0.16
Name Modified Size InfoDownloads / Week
Parent folder
checksums.sha256 2026-10-14 2.9 kB
0
checksums.sha256.pem 2026-10-14 3.3 kB
0
checksums.sha256.sig 2026-10-14 96 Bytes
0
kubescape.exe_4.0.16_windows_amd64.sbom.json 2026-10-14 1.0 MB
0
kubescape.exe_4.0.16_windows_arm64.sbom.json 2026-10-14 1.0 MB
0
kubescape_4.0.16_darwin_amd64.sbom.json 2026-10-14 1.0 MB
0
kubescape_4.0.16_darwin_arm64.sbom.json 2026-10-14 1.0 MB
0
kubescape_4.0.16_linux_arm64.sbom.json 2026-10-14 1.0 MB
0
downloader_4.0.16_linux_arm64.sbom.json 2026-10-14 1.0 MB
0
ksserver_4.0.16_linux_amd64.sbom.json 2026-10-14 1.0 MB
0
ksserver_4.0.16_linux_arm64.sbom.json 2026-10-14 1.0 MB
0
kubescape_4.0.16_linux_amd64.sbom.json 2026-10-14 1.0 MB
0
downloader_4.0.16_linux_amd64.sbom.json 2026-10-14 1.0 MB
0
kubescape_4.0.16_linux_amd64.deb 2026-10-14 121.1 MB
0
kubescape_4.0.16_linux_arm64.deb 2026-10-14 112.0 MB
0
kubescape_4.0.16_darwin_amd64 2026-10-14 304.7 MB
0
kubescape_4.0.16_darwin_amd64.tar.gz 2026-10-14 127.8 MB
0
kubescape_4.0.16_darwin_arm64 2026-10-14 289.6 MB
0
kubescape_4.0.16_darwin_arm64.tar.gz 2026-10-14 121.4 MB
0
kubescape_4.0.16_linux_amd64 2026-10-14 295.2 MB
0
kubescape_4.0.16_linux_amd64.apk 2026-10-14 124.4 MB
0
kubescape_4.0.16_linux_amd64.rpm 2026-10-14 121.1 MB
0
kubescape_4.0.16_linux_amd64.tar.gz 2026-10-14 121.1 MB
2 2 weekly downloads
kubescape_4.0.16_linux_arm64 2026-10-14 277.7 MB
0
kubescape_4.0.16_linux_arm64.apk 2026-10-14 114.8 MB
0
kubescape_4.0.16_linux_arm64.rpm 2026-10-14 112.0 MB
0
kubescape_4.0.16_linux_arm64.tar.gz 2026-10-14 112.0 MB
0
kubescape_4.0.16_windows_amd64.exe 2026-10-14 297.1 MB
0
kubescape_4.0.16_windows_amd64.tar.gz 2026-10-14 122.0 MB
0
kubescape_4.0.16_windows_arm64.exe 2026-10-14 277.2 MB
0
kubescape_4.0.16_windows_arm64.tar.gz 2026-10-14 111.9 MB
0
README.md 2026-10-14 9.8 kB
0
v4.0.16 source code.tar.gz 2026-10-14 13.5 MB
0
v4.0.16 source code.zip 2026-10-14 14.6 MB
0
Totals: 34 Items   3.2 GB 2

Changelog

  • [02cd40] Feat/rbac parity differential testing (#4076)
  • [58b7c1] Fix file permission gosec warnings in httphandler tests (#3924)
  • [4a3ccb] Honor control exclusions in HTTP scans (#4116)
  • [b83f2b] chore(containerscan): remove unused core/pkg/containerscan package (#4069)
  • [a39604] chore(deps): bump github.com/kubescape/go-logger from 0.0.34 to 0.0.35 (#4084)
  • [d74096] chore(resultshandling): remove dead legacy wrappers superseded by ResourceCatalog (#4082)
  • [a11152] ci(security-insights): migrate to Security Insights v2.2.0 (#4059)
  • [839c9f] ci(workflows): remove Codium-ai pr-agent (#3973)
  • [9dbcc0] ci: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4136)
  • [76b23b] ci: bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 (#4050)
  • [b0c170] ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#3898)
  • [d6623f] ci: bump github.com/docker/cli from 29.7.2+incompatible to 29.9.0+incompatible (#4130)
  • [42456a] ci: bump github.com/kubescape/rbac-utils from 0.0.21 to 0.0.22 (#4127)
  • [0909d9] ci: bump github.com/kubescape/regolibrary/v2 from 2.0.36 to 2.0.38 (#4126)
  • [e1d352] ci: bump github.com/quay/claircore from 1.5.54 to 1.6.1 (#4129)
  • [74164d] ci: bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#4045)
  • [df2bec] ci: bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 (#4135)
  • [d145b2] ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.45.0 to 1.47.0 (#4047)
  • [af5ce7] ci: bump golang.org/x/term from 0.46.0 to 0.47.0 (#4128)
  • [bddb17] ci: bump google.golang.org/api from 0.297.0 to 0.300.0 (#3961)
  • [668261] ci: bump helm/kind-action from 1.15.0 to 1.15.1 (#4137)
  • [a9f192] ci: bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 (#4133)
  • [d01c1d] ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#4049)
  • [5c63ca] ci: skip PR scanner jobs per job instead of by paths-ignore (#4098)
  • [e7f54b] docs(fix): document every --output-dir refusal, and --interactive (#4110)
  • [848979] docs(security-insights): add contribution review policy (#4145)
  • [893655] feat(diff): compare image scan reports to surface new and resolved vulnerabilities (#3957)
  • [3b7b90] feat(fix): add interactive mode for granular remediation (#3914)
  • [48d62c] feat(fleet): retry clusters whose API server never answered [LFX 2026] (#4113)
  • [050638] feat(imagescan): add Red Hat Quay vulnerability adaptor (#4081)
  • [4d883d] feat(mcp): add list_admission_policies tool (#4112)
  • [071a01] feat(mcp): log tool-call metadata at debug level (#4123)
  • [2e978a] feat(mcpserver): add PSS compliance prediction tool (#4011)
  • [856e47] feat(mcpserver): add secret exposure detection tool (#4099)
  • [f96a14] feat(mcpserver): expose scan report comparison via diff_reports tool (#4040)
  • [0d924d] feat(pdf): report scan coverage and skipped-control diagnostics (#3958) (#3959)
  • [fdc344] feat(printer): add scan coverage to PDF and docs (#3977)
  • [5b7739] feat(printer): include skipped and unevaluated controls in junit report (#4014) (#4015)
  • [8b3fe4] feat(printer): surface attack-path priority score and severity in SARIF result properties (#4004)
  • [aff609] feat(pss): add PSS compliance predictor CLI (#4055)
  • [5a0b79] feat(pss): add Pod Security Standards evaluation library (#4003)
  • [46931e] feat(scan): add --kube-version and --api-versions for Helm rendering (#4143)
  • [3649b0] feat(vulnexposure): account for external exposure in vulnerability analysis (#4064)
  • [6b8f6c] fix(baseline): handle CloseWriter error on success path in writeBaselineHeadReport (#4006)
  • [c012ba] fix(cel): collect Namespace context beyond workload filters (#4062)
  • [3b5f86] fix(config): reject empty config set values instead of silently keeping the old value (#3986)
  • [01ce22] fix(core): respect context cancellation in credential retry loop (#3998)
  • [1b9191] fix(core): reuse initialized Kubernetes client across scan interfaces (#3979)
  • [9c4acd] fix(csv): include delete paths in the failed paths column (#4086)
  • [30937b] fix(deps): upgrade Trivy to address Dependabot alerts (#4131)
  • [642128] fix(deps): upgrade containerd, cilium and OpenTelemetry to patched releases (#4066)
  • [fe9d1b] fix(download): include security view frameworks in download artifacts (#4119)
  • [3524f7] fix(e2e): get the E2E run ID from the dispatch response (#4068)
  • [c612b8] fix(exposure): honor Gateway listener hostname intersection (#4089)
  • [61860a] fix(exposure): honor Gateway parent listener ports (#4102)
  • [47c6c5] fix(exposure): ignore zero-weight Gateway backends (#4101)
  • [beeb55] fix(exposure): resolve HTTP backend Service ports (#4151)
  • [4a5e35] fix(exposure): respect Gateway listener protocol compatibility (#4120)
  • [f476ba] fix(fix): fix multi-input scans outside git and recreate their tree under --output-dir (#4054)
  • [5ce947] fix(fleet): report a cluster as unreachable only when it never answered (#4022)
  • [388a23] fix(httphandler): cancel scan on client disconnect in /v1/metrics (#4039)
  • [d90f77] fix(httphandler): create scan result files with 0600 and redact paths from scan errors (#4016)
  • [1bba0b] fix(httphandler): dynamically reload TLS key pair on file update (#4105)
  • [d6914c] fix(httphandler): read metrics results from the prometheus .txt path (#3981)
  • [0307d8] fix(image): fail loudly on --exceptions with non-registry inputs (#3824)
  • [369227] fix(imagescan): add scan status to vulnerability reports (#4074)
  • [dbcf54] fix(imagescan): apply exponential backoff on Quay HTTP 429 when Retry-After is omitted (#3996)
  • [805f9e] fix(imagescan): guard Harbor and GitLab redirect origins (#4147)
  • [a3959b] fix(imagescan): inspect complete GCP scan status (#4051)
  • [c63a89] fix(imagescan): keep Quay credentials within their registry origin (#4134)
  • [712321] fix(imagescan): keep latest Harbor scan status (#4052)
  • [726ed5] fix(imagescan): match GitLab findings to exact image identity (#4122)
  • [b65827] fix(imagescan): normalize RHSA severity labels in Quay adaptor (#4035)
  • [c3a833] fix(imagescan): preserve Quay redirect trust across callbacks (#4150)
  • [219573] fix(imagescan): query ECR scans in the image registry region (#4132)
  • [99621c] fix(imagescan): query the ECR image owner account (#4090)
  • [1a12f8] fix(imagescan): record resolved manifest digest into ImageID.Hash for Quay scans (#3994)
  • [2d6c5c] fix(imagescan): resolve GitLab registry project boundaries (#4121)
  • [17e6da] fix(imagescan): retain GCP findings on discovery errors (#4149)
  • [d79180] fix(imagescan): select newest Azure scan assessment (#4152)
  • [0d76fe] fix(imagescan): validate Harbor image registry ownership (#4148)
  • [ea6366] fix(install): handle null user PATH and add non-interactive flags in install.ps1 (#4065)
  • [ba6e27] fix(kustomize): allow only builtin plugins when rendering Kustomizations (#4031)
  • [640d82] fix(kustomize): report Kustomize sources relative to the repo root (#3954)
  • [4b4af2] fix(mcpserver): harden argument validation and bounds for advanced tools (#4075)
  • [59a11c] fix(mcpserver): harmonize tool argument validation with structured errors (#4100)
  • [8ba0d9] fix(mcpserver): reject cross-origin requests to the SSE transport (#4032)
  • [2c8b4a] fix(mcpserver): serve MCP initialize before the policy bundle loads (#4144)
  • [bb4ebe] fix(networkpolicy): evaluate ipBlock peers against every IP of a dual-stack pod (#4140)
  • [15346b] fix(networkpolicy): report hostNetwork pods as unknown instead of isolated (#4060)
  • [12526c] fix(opaprocessor): keep rules that compare input objects out of the incremental cache (#4021)
  • [210af8] fix(partitionstore): prevent critical file descriptor leak in fdPool.closeAll on flush failure (#3988)
  • [8e4f2f] fix(policyreport): surface cluster-wide skipped controls and diagnostics in ClusterPolicyReport (#3989) (#3990)
  • [c44b4c] fix(predict): create output directories and restrict file permissions to 0600 (#4083)
  • [e5f6aa] fix(predict): sort SARIF rules for determinism and improve report compatibility (#4097)
  • [bf42ab] fix(printer): keep multi-line control remediation inside the markdown report blockquote (#4061)
  • [64ff26] fix(prometheus): emit kubescape_resource_count_controls_passed metric (#4013)
  • [230d2a] fix(prometheus): omit complianceScore metric when score is unset (#4017) (#4018)
  • [3bb8df] fix(pss): match the Kubernetes Pod Security Standards evaluator (#4036)
  • [ebc2fc] fix(rbacgraph): handle an empty name in resourceNames as the authorizer does (#4117)
  • [2bfda3] fix(rbacgraph): keep resourceNames restrictions literal (#4088)
  • [c99934] fix(rbacgraph): resolve a ServiceAccount subject without a namespace in its RoleBinding's namespace (#4053)
  • [6017cc] fix(scan): honor --output /dev/null in --kube-contexts fleet scans (#3846)
  • [d0ea07] fix(scan): measure full call in fleet timeout test (#4155)
  • [af7a94] fix(scan): read SecurityException CRDs only on cluster scans (#4125)
  • [4ccc40] fix(scan-integrity): fail closed on whole-cluster verify parity mismatch (#4000)
  • [80cbaa] fix(storage): clear remediated findings on later scans (#4044)
  • [c5e20d] fix(storage): skip results with non-RBAC related objects instead of aborting persistence (#4057)
  • [b1726a] perf(mcpserver): deduplicate concurrent analysis requests (#4146)
  • [041bce] perf(opaprocessor): cache prepared rego evaluation queries to reduce scan overhead (#4030)
  • [88db8b] perf(partitionstore): avoid redundant DeepCopy before disk serialization in DiskStore.Put (#3971)
  • [6fd7b7] style(fixhandler): gofmt the UnfixedControl struct (#4019)
  • [22afdf] test(ghworkflows): guard go.mod replace directives (#3992)
  • [1cf405] test(printer): add regression coverage for secure report file permissions (#4092)
  • [65639c] test(pss): expand upstream parity coverage (#4093)

Released by GoReleaser.

Source: README.md, updated 2026-10-14