Description

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants' resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants' secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-01T12:17:49.407Z",
  "pubdate": "2026-09-01T12:17:49.407Z",
  "executiveSummary": "A critical Server-Side Request Forgery (SSRF) vulnerability exists in Kyverno versions prior to 1.16.2 within the APICall feature.\nThe vulnerability arises from insufficient validation of the URL field within a Policy's ServiceCall configuration.\nAn attacker possessing namespace-level Policy creation permissions can exploit this to force the Kyverno controller to execute HTTP requests against arbitrary internal network resources.\nBecause Kyverno operates with a high-privilege cluster-wide ServiceAccount, this facilitates a Confused Deputy scenario where the application performs requests on behalf of the attacker.\nThe primary impact includes unauthorized access to sensitive cloud metadata services (e.g., 169.254.169.254), internal service endpoints, and potential exfiltration of cloud IAM credentials or secret data.\nThis vulnerability compromises multi-tenant isolation, allowing users with limited scope to escalate privileges and access unauthorized resources across the cluster infrastructure.",
  "technicalDetails": "The vulnerability resides in the Kyverno APICall functionality, specifically within the logic processing the ServiceCall configuration. The root cause is a lack of input validation or sanitization on the URL parameter provided in policy definitions.\nAttack Flow: An attacker with permissions to create or update Kyverno Policies can craft a malicious Policy containing a ServiceCall block. By manipulating the URL field, the attacker directs the Kyverno controller to initiate an outbound HTTP request to an arbitrary destination, including non-routable internal IP addresses or restricted cloud provider metadata services.\nExploitation Method: Since Kyverno runs with elevated privileges via its cluster-wide ServiceAccount, the controller performs the requested network interaction with the authority of these credentials. When the controller executes the call, the response from the target resource is returned and subsequently embedded within the generated PolicyReport.\nPost-Exploitation: The attacker can retrieve the content of the PolicyReport to view the response payload. By targeting cloud metadata endpoints, an attacker can extract sensitive information such as IAM security tokens, node metadata, or environment-specific configuration data. This effectively circumvents Kubernetes RBAC and network segmentation, as the Kyverno controller serves as an authorized proxy for the attacker’s requests.\nAffected Versions: All Kyverno versions prior to 1.16.2. The vulnerability specifically impacts the APICall component, which is responsible for external service lookups.\nAuthentication/Privilege Requirements: The attacker must have sufficient permissions to create or update Kyverno policies within at least one namespace. No external authentication is required if the attacker already has legitimate access to the cluster's policy creation API.\nNetwork Exposure: The vulnerability is triggered from within the cluster, utilizing the network reachability of the Kyverno controller pod. This allows access to internal infrastructure that is otherwise protected from the attacker's direct network path."
}