{"id":"EUVD-2025-210816","enisaUuid":"2be9abf5-ed48-34d9-a1c0-b27fd45bf258","description":"Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy\u0027s apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.","datePublished":"Sep 1, 2026, 11:33:51 AM","dateUpdated":"Sep 1, 2026, 12:15:06 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq\nhttps://www.vulncheck.com/advisories/kyverno-before-1.13.4-ssrf-via-service-call\n","aliases":"CVE-2025-15613\nGHSA-8g8h-v9pm-r6xg\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"9f36227c-60e9-3e44-9bbc-7073056515b6","product":{"name":"kyverno","vendor":{"name":"kyverno"}},"product_version":"0 \u003c1.13.4"}],"enisaIdVendor":[{"id":"1db8084a-8104-3ab6-b66c-bf4aae283c5d","vendor":{"name":"kyverno"}}],"enisaIdVulnerability":[{"id":"4f6f14da-99aa-3f99-83fd-3cee6759333a","vulnerability":{"id":"GHSA-8g8h-v9pm-r6xg","description":"Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy\u0027s apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.","datePublished":"Sep 1, 2026, 12:31:49 PM","dateUpdated":"Sep 1, 2026, 12:31:49 PM","baseScore":0.0,"references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-15613\nhttps://www.vulncheck.com/advisories/kyverno-before-1.13.4-ssrf-via-service-call\n","enisa_id":"EUVD-2025-210816\n","aliases":"GHSA-8g8h-v9pm-r6xg\nCVE-2025-15613\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:00:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a42d8c3b-6759-3602-a6c8-fd725319e714","vulnerability":{"id":"CVE-2025-15613","description":"Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy\u0027s apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.","datePublished":"Sep 1, 2026, 11:33:51 AM","dateUpdated":"Sep 1, 2026, 12:15:06 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq\nhttps://www.vulncheck.com/advisories/kyverno-before-1.13.4-ssrf-via-service-call\n","enisa_id":"EUVD-2025-210816\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Oct 31, 2026, 7:17:56 AM","vulnerabilityProduct":[{"id":"15e0d415-3367-3359-8006-770a9d3fe455","product":{"name":"kyverno","vendor":{"name":"kyverno"}},"product_version":"0 \u003c1.13.4"}],"vulnerabilityVendor":[{"id":"e6e739cc-207b-3dfb-b4cd-edf3e6dba8af","vendor":{"name":"kyverno"}}]}}],"enisaIdAdvisory":[]}