{"id":"EUVD-2026-69034","enisaUuid":"58423860-52be-31a9-acc4-21da4a9933d7","description":"Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy\u0027s ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants\u0027 resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants\u0027 secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.","datePublished":"Sep 1, 2026, 11:33:59 AM","dateUpdated":"Oct 8, 2026, 3:25:45 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-fmqp-4wfc-w3v7\nhttps://www.vulncheck.com/advisories/kyverno-before-1.16.2-ssrf-via-apicall-feature\n","aliases":"CVE-2026-84199\nGHSA-q5v3-pp68-6crj\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"6d1c8a3e-5c6c-39e2-be63-e803a7c6272f","product":{"name":"kyverno","vendor":{"name":"kyverno"}},"product_version":"0 \u003c1.16.2"}],"enisaIdVendor":[{"id":"66fa9362-34f2-30cc-98c5-e992a4ce11a1","vendor":{"name":"kyverno"}}],"enisaIdVulnerability":[{"id":"65a54c43-2fa4-3535-8815-0a250d421a93","vulnerability":{"id":"CVE-2026-84199","description":"Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy\u0027s ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants\u0027 resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants\u0027 secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.","datePublished":"Sep 1, 2026, 11:33:59 AM","dateUpdated":"Oct 8, 2026, 3:25:45 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-fmqp-4wfc-w3v7\nhttps://www.vulncheck.com/advisories/kyverno-before-1.16.2-ssrf-via-apicall-feature\n","enisa_id":"EUVD-2026-69034\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Nov 7, 2026, 7:17:03 AM","vulnerabilityProduct":[{"id":"e3c89bee-97a7-323c-b7f5-bd22d0476a55","product":{"name":"kyverno","vendor":{"name":"kyverno"}},"product_version":"0 \u003c1.16.2"}],"vulnerabilityVendor":[{"id":"1aed802d-66d0-321d-ba2e-35a51bdbe3ac","vendor":{"name":"kyverno"}}]}},{"id":"98e1013c-88a8-3f74-ba2c-2e1bdb93a443","vulnerability":{"id":"GHSA-q5v3-pp68-6crj","description":"Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy\u0027s ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants\u0027 resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants\u0027 secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.","datePublished":"Sep 1, 2026, 12:31:51 PM","dateUpdated":"Sep 1, 2026, 12:31:51 PM","baseScore":0.0,"references":"https://github.com/kyverno/kyverno/security/advisories/GHSA-fmqp-4wfc-w3v7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84199\nhttps://www.vulncheck.com/advisories/kyverno-before-1.16.2-ssrf-via-apicall-feature\n","enisa_id":"EUVD-2026-69034\n","aliases":"CVE-2026-84199\nGHSA-q5v3-pp68-6crj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}