Description

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-01T12:17:49.270Z",
  "pubdate": "2026-09-01T12:17:49.270Z",
  "executiveSummary": "Kyverno versions prior to 1.18.0 are susceptible to a server-side request forgery (SSRF) vulnerability located within the apiCall.service.url configuration.\nThis vulnerability allows an authenticated user to manipulate variable substitution mechanisms to inject malicious input, forcing the Kyverno controller to initiate arbitrary HTTP requests.\nThe primary impact of this flaw includes unauthorized access to internal network resources, interaction with cloud provider metadata services, and exploitation of loopback addresses.\nCrucially, because the application reflects the results of these requests within admission controller error messages, the vulnerability enables non-blind data exfiltration, allowing attackers to read sensitive internal data.\nThe risk is significant for Kubernetes environments where the Kyverno pod possesses elevated service account permissions, as an attacker can leverage the controller's identity to query services that are otherwise inaccessible from outside the cluster.\nExploitation requires the attacker to possess sufficient privileges to define or modify Kyverno policies, making this a concern for environments with delegated policy management.",
  "technicalDetails": "The vulnerability resides within the Kyverno policy evaluation engine, specifically in the component responsible for processing apiCall.service definitions. The engine performs variable substitution on the 'url' field, which is intended to facilitate dynamic API lookups during policy validation.\nThe root cause is an insufficient validation and sanitization of user-supplied inputs used during the variable substitution phase. When a user defines a policy containing an apiCall, they can inject crafted parameters into the URL string. Because the Kyverno controller acts as the execution proxy for these requests, it fails to implement a robust allow-list or filter on the target destinations.\nThe attack flow proceeds as follows: An authenticated user with permissions to create or update Kyverno policies submits a malicious policy object. The 'url' field within the apiCall.service block is populated with an attacker-controlled URI, such as 'http://169.254.169.254/latest/meta-data/' or an internal cluster service endpoint (e.g., 'http://internal-service:8080/sensitive-data').\nUpon triggering the policy—typically during resource admission—the Kyverno engine resolves the variable substitution and attempts to execute an HTTP request to the attacker-defined target. The controller performs the request from its own network context. If the request is successful, the Kyverno admission controller captures the response body or header data.\nThe vulnerability is further exacerbated by the reflection of these responses in admission error messages. By design, if an apiCall fails or produces an unexpected output, Kyverno may include this information in the API response returned to the user, effectively bypassing the 'blind' nature of typical SSRF attacks. This facilitates the exfiltration of internal configuration files, environment variables, or metadata credentials.\nThe scope of impact is broad, as the Kyverno controller often runs with a high-privilege ServiceAccount to facilitate its cluster-wide operations. By coercing the controller to act as a proxy, an attacker can bypass network policies and access internal REST APIs, databases, or cloud-native metadata services that are restricted to local VPC access. The lack of strict URL schema validation or destination network filtering in versions prior to 1.18.0 creates a persistent path for lateral movement and privilege escalation within the Kubernetes cluster."
}