Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-84196 · Microsoft / collected KEV context

EUVD-2026-69033

GHSA-xcg3-vhqm-f4qw

GHSA-qr4g-8hrp-c4rw

BIT-kyverno-2026-84196

GO-2026-5594

cve-program · CVE-2026-84196

• https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw
• https://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall

euvd · EUVD-2026-69033

• https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw
• https://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall

nvd · CVE-2026-84196

• https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw
• https://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall

osv · GHSA-qr4g-8hrp-c4rw

• https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw
• https://github.com/kyverno/kyverno

osv · GO-2026-5594

• https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw

No related operational record is retained in the current change model.