{"id":"EUVD-2026-69033","enisaUuid":"48bd2467-3f99-3fb4-ab17-975cdff410b6","description":"Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.","datePublished":"Sep 1, 2026, 11:33:59 AM","dateUpdated":"Sep 1, 2026, 2:56:10 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw\nhttps://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall\n","aliases":"CVE-2026-84196\nGHSA-xcg3-vhqm-f4qw\n","assigner":"VulnCheck","epss":0.35,"enisaIdProduct":[{"id":"caaa389c-8c17-32b4-961d-fe36a2aea734","product":{"name":"kyverno","vendor":{"name":"kyverno"}},"product_version":"0 \u003c1.18.0"}],"enisaIdVendor":[{"id":"21310a83-5546-37b1-b659-9372664c03cc","vendor":{"name":"kyverno"}}],"enisaIdVulnerability":[{"id":"21a18b1e-506e-3788-8ff9-eafaa0e8ae4d","vulnerability":{"id":"CVE-2026-84196","description":"Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.","datePublished":"Sep 1, 2026, 11:33:59 AM","dateUpdated":"Sep 1, 2026, 2:56:10 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw\nhttps://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall\n","enisa_id":"EUVD-2026-69033\n","assigner":"VulnCheck","epss":0.35,"dataProcessed":"Nov 11, 2026, 7:18:33 AM","vulnerabilityProduct":[{"id":"68cc7ea7-0db8-3980-83bd-621042f60849","product":{"name":"kyverno","vendor":{"name":"kyverno"}},"product_version":"0 \u003c1.18.0"}],"vulnerabilityVendor":[{"id":"65298e09-bcb3-3acb-b6e9-624e3eb7c7f1","vendor":{"name":"kyverno"}}]}},{"id":"a07374f5-830a-313b-b538-92c701272b0f","vulnerability":{"id":"GHSA-xcg3-vhqm-f4qw","description":"Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.","datePublished":"Sep 1, 2026, 12:31:51 PM","dateUpdated":"Sep 1, 2026, 12:31:51 PM","baseScore":0.0,"references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84196\nhttps://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall\n","enisa_id":"EUVD-2026-69033\n","aliases":"GHSA-xcg3-vhqm-f4qw\nCVE-2026-84196\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}