Executive brief
Kyverno, a policy engine for Kubernetes, contains a vulnerability that allows users with basic permissions to trick the system into making unauthorized network requests. An attacker can exploit this to access sensitive internal services, such as cloud metadata endpoints or internal databases, that are normally protected from outside access. Because the system returns the results of these requests in error messages, an attacker can steal sensitive data like cloud credentials or internal configuration details.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Kyverno's `apiCall.service.url` implementation due to insufficient validation of variable substitutions. When a `ClusterPolicy` uses user-controlled input (e.g., `{{request.object.*}}`) to construct a URL, the Kyverno admission controller executes the request from its privileged network position without IP filtering or URL normalization. This allows attackers to target loopback addresses, internal ClusterIP services, and cloud metadata services (IMDS). The vulnerability is non-blind because Kyverno reflects response bodies back to the user in admission error messages when requests fail or JSON parsing fails. As of the advisory, no patched version is available for versions <= 1.17.1.
Affected products
- Kyverno Kyverno <= 1.17.1
Timeline
- 2026-04-13: disclosed: Initial disclosure by reporter
- 2026-04-14: advisory: GitHub Advisory published