Executive brief
Kyverno is a policy engine for Kubernetes that validates and mutates cluster configurations. The APICall feature allows policies to fetch data from HTTP services, but fails to validate target URLs. An attacker with namespace-level policy creation permissions can exploit this to make Kyverno fetch sensitive data (cloud credentials, other tenants' secrets) from internal resources using Kyverno's high-privilege service account, breaking multi-tenant isolation in shared Kubernetes environments.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in Kyverno's APICall feature. The URL field in a Policy's ServiceCall configuration (api/kyverno/v1/common_types.go) is not validated before use, allowing attacker-controlled input to reach the HTTP request execution code (pkg/engine/apicall/executor.go, line 80). An authenticated attacker with namespace-level Policy creation permissions can craft policies that direct Kyverno to request arbitrary internal addresses (e.g., 169.254.169.254 cloud metadata, other tenants' service endpoints). Because Kyverno executes these requests using a cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the HTTP responses—containing cloud IAM credentials, database passwords, API keys, or other tenants' secrets—are returned in PolicyReports readable by the attacker. No cluster-admin privileges are required. The vulnerability affects versions before 1.16.2; patches are available in 1.16.2 and later.
Affected products
- Kyverno Kyverno before 1.16.2
Timeline
- 2026-04-13: advisory
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in Kyverno 1.16.2