CVE-2026-84199

A flaw was found in Kyverno. A Server-Side Request Forgery SSRF vulnerability exists in the APICall feature due to improper validation of the URL field in a Policy's ServiceCall configuration. A user with namespace-level Policy creation permissions can exploit this to direct Kyverno to make HTTP...

CVE-2026-84199

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

CVE-2026-84199

Kyverno before 1.16.2 is affected by a server-side request forgery (SSRF) vulnerability in its APICall feature. The URL field in a Policy's ServiceCall configuration is not validated , allowing a user with namespace-level Policy creation permissions to direct Kyverno to make HTTP requests to arbi...

CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

SUSE CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

CVE-2026-41323 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the APICall feature. An attacker can access sensitive internal resources and exfiltrate confidential data by supplying arbitrary URLs to the APICall feature, which are executed with elevated privilege...