CVE-2026-84199: Kyverno APICall server-side request forgery (SSRF) via unvalidated URL

CVE-2026-84199 · Severity: high · CVSS 7.7 · Published 2026-09-01

Kyverno is a policy engine for Kubernetes that validates and mutates cluster configurations. The APICall feature allows policies to fetch data from HTTP services, but fails to validate target URLs. An attacker with namespace-level policy creation permissions can exploit this to make Kyverno fetch sensitive data (cloud credentials, other tenants' secrets) from internal resources using Kyverno's high-privilege service account, breaking multi-tenant isolation in shared Kubernetes environments.

Technologies: github.com/kyverno/kyverno (Go), Kyverno. Vendors: Go, Kyverno.

Quick answers

Is CVE-2026-84199 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84199 being exploited in the wild.
How severe is CVE-2026-84199?
High severity, with a CVSS score of 7.7, published 1 September 2026.
Which products and versions are affected?
github.com/kyverno/kyverno (Go) SEMVER:introduced=0,fixed=1.16.2; Kyverno before 1.16.2.
Is there a fix for CVE-2026-84199?
Yes. github.com/kyverno/kyverno (Go): upgrade to 1.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84199 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-84199?
Check whether you run github.com/kyverno/kyverno (Go) or Kyverno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/kyverno/kyverno (Go): upgrade to 1.16.2 or later
    go get github.com/kyverno/kyverno@v1.16.2

Technical details

This is a Server-Side Request Forgery (SSRF) vulnerability in Kyverno's APICall feature. The URL field in a Policy's ServiceCall configuration (api/kyverno/v1/common_types.go) is not validated before use, allowing attacker-controlled input to reach the HTTP request execution code (pkg/engine/apicall/executor.go, line 80). An authenticated attacker with namespace-level Policy creation permissions can craft policies that direct Kyverno to request arbitrary internal addresses (e.g., 169.254.169.254 cloud metadata, other tenants' service endpoints). Because Kyverno executes these requests using a cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the HTTP responses—containing cloud IAM credentials, database passwords, API keys, or other tenants' secrets—are returned in PolicyReports readable by the attacker. No cluster-admin privileges are required. The vulnerability affects versions before 1.16.2; patches are available in 1.16.2 and later.

Affected products

  • Kyverno Kyverno before 1.16.2

Identifiers

  • CVE-2026-84199
  • GHSA-fmqp-4wfc-w3v7
  • GO-2026-5371

Timeline

  • 2026-04-13: advisory
  • 2026-09-01: disclosed
  • 2026-09-01: patched: Fixed in Kyverno 1.16.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.