Kyverno SSRF in APICall feature leading to multi-tenant breach

Executive brief

Kyverno, a policy engine for Kubernetes, contains a vulnerability in its APICall feature that allows users to perform Server-Side Request Forgery (SSRF). In shared environments, a user with limited permissions can create a policy that forces Kyverno to use its high-level system privileges to steal sensitive data from other tenants, such as database passwords or cloud provider credentials. This can lead to a complete breach of isolation between different teams or customers using the same cluster.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Kyverno's APICall mechanism due to a lack of URL validation in the 'executeServiceCall' function. An attacker with namespace-level permissions to create Kyverno Policies can define a 'ServiceCall' with a malicious URL targeting internal Kubernetes services or cloud metadata endpoints (e.g., 169.254.169.254). Because Kyverno executes these requests using its own cluster-wide high-privilege ServiceAccount, it acts as a 'confused deputy,' allowing low-privilege tenants to exfiltrate secrets or IAM credentials into PolicyReports. The vulnerability is patched in version 1.16.2.

Affected products

• Kyverno Kyverno < 1.16.2

Timeline

• 2026-04-13: advisory: GitHub Advisory published
• 2026-04-14: patched: Vulnerability fixed in version 1.16.2

References

• https://api.github.com/users/b0b0haha
• https://github.com/b0b0haha
• https://api.github.com/users/b0b0haha/gists%7B/gist_id%7D
• https://api.github.com/users/b0b0haha/repos
• https://avatars.githubusercontent.com/u/28356082?v=4
• https://api.github.com/users/b0b0haha/events%7B/privacy%7D