Executive brief
Kyverno, a policy engine for Kubernetes, contains a flaw where it automatically attaches its own administrative security credentials to outbound web requests. If a policy is configured to connect to an external or malicious server, these credentials can be stolen by the receiver. An attacker who obtains these credentials could gain full control over cluster policies, read sensitive data, or escalate their privileges within the Kubernetes environment.
Technical details
Kyverno's apiCall executor in `pkg/engine/apicall/executor.go` is designed to read the ServiceAccount (SA) token from the standard Kubernetes secret path and inject it into the 'Authorization' header of HTTP requests. This behavior occurs automatically if no explicit Authorization header is defined in the policy, and it lacks trust boundary validation to distinguish between internal and external endpoints. An attacker with the ability to create or influence Kyverno policies can direct an apiCall to a controlled server to exfiltrate the SA token. This token typically possesses high-level permissions, including the ability to manage webhooks and read cluster-wide resources. The issue is addressed in version 1.17.0.
Affected products
- Kyverno Kyverno < 1.17.0
Timeline
- 2026-04-15: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched: Patched in version 1.17.0