Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Source published

1 Sep 2026 11:33:59 UTC

Source modified

1 Sep 2026 14:56:10 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 8.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1 · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Source published

Sep 1, 2026, 11:33:59 AM (timezone not stated)

Source modified

Sep 1, 2026, 2:56:10 PM (timezone not stated)

Saved here

11 Nov 2026 17:00:43 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 8.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

Source published

1 Sep 2026 12:17:49 UTC

Source modified

10 Sep 2026 15:43:03 UTC

Saved here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 8.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Summary A Server-Side Request Forgery (SSRF) vulnerability in Kyverno allows authenticated users to induce the admission controller to send arbitrary HTTP requests to attacker-controlled endpoints. When a `ClusterPolicy` uses `apiCall.service.url` with variable substitution (e.g. `{{request.object.*}}`), user-controlled input can influence the request target. The Kyverno admission controller executes these requests from its privileged network position without enforcing any validation or network restrictions. The issue becomes **non-blind SSRF**, as response data from internal services can be reflected back to the user via admission error messages. --- ### Details Kyverno supports variable substitution in `apiCall.service.url`, a documented feature intended to enable dynamic external lookups during admission control. However, the current implementation lacks fundamental safeguards in the HTTP execution path: #### Missing protections - **No URL validation** User-controlled input is directly embedded into the request URL without validation or normalization. - **No IP filtering** Requests can target: - Loopback (`127.0.0.1`) - Link-local (`169.254.0.0/16`) - Cloud metadata services (e.g. AWS IMDS) - Internal ClusterIP services - **Redirect handling not restricted** The Go HTTP client uses default redirect behavior (`CheckRedirect == nil`), allowing up to 10 redirects without re-validation of the target. - **Response data reflection in admission errors** Response bodies are propagated back to the user in admission responses under certain conditions. #### Non-blind SSRF behavior The vulnerability is **non-blind** through two mechanisms: 1. **Non-2xx responses** Response body is returned in admission error messages (e.g. `executor.go:98-101`) 2. **2xx responses with non-JSON content** Parsing failures (JSON/JMESPath) include response snippets in error output This allows attackers to retrieve data from internal services directly via `kubectl` output. --- ### PoC #### Preconditions 1. A `ClusterPolicy` using: ```yaml apiCall: service: url: "http://{{ request.object.metadata.annotations.target }}" ``` 2. An authenticated user able to create matching resources (e.g. Pods) --- #### Step 1 — Create malicious resource ```yaml apiVersion: v1 kind: Pod metadata: name: ssrf-test annotations: target: "169.254.169.254/latest/meta-data/iam/security-credentials/" spec: containers: - name: test image: nginx ``` --- #### Step 2 — Apply resource ```bash kubectl apply -f pod.yaml ``` --- #### Step 3 — Observe output Example output: ```text Error from server: admission webhook "kyverno" denied the request: failed to process apiCall: <response body from metadata service> ``` --- #### Variations - Internal services: http://kubernetes.default.svc - Loopback: http://127.0.0.1:8080 - Redirect chains to bypass naive filters --- ### Impact #### Vulnerability class - Server-Side Request Forgery (SSRF) - Non-blind data exfiltration #### Affected scope - Kubernetes clusters using Kyverno policies with `apiCall.service.url` and variable substitution #### Impact details - Access to internal services (ClusterIP, localhost) - Access to cloud metadata endpoints (e.g. IMDSv1 → credential exposure) - Internal network reconnaissance - Multi-tenant boundary weakening This issue can be combined with automatic ServiceAccount token forwarding (reported separately) to form a **critical attack chain**.

Source published

14 Apr 2026 20:05:52 UTC

Source modified

25 Sep 2026 14:25:34 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Publisher rating · HIGH

Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno

Source published

25 Jun 2026 22:34:34 UTC

Source modified

25 Sep 2026 14:25:34 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.