CVE-2026-84195
published 2026-09-01CVE-2026-84195: Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit…
PriorityP347high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.39%
32.4th percentile
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kyverno | kyverno | < 1.16.4 | 1.16.4 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers.
ghsa_unreviewed·2026-09-01
CVE-2026-84195 [HIGH] CWE-200 Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers.
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.
Red Hat
github.com/kyverno/kyverno: Kyverno: Credential leak via apiCall leads to unauthorized cluster resource control
vendor_redhat·2026-09-01·CVSS 7.7
CVE-2026-84195 [HIGH] CWE-497 github.com/kyverno/kyverno: Kyverno: Credential leak via apiCall leads to unauthorized cluster resource control
github.com/kyverno/kyverno: Kyverno: Credential leak via apiCall leads to unauthorized cluster resource control
A flaw was found in Kyverno, a policy engine for Kubernetes. This vulnerability allows attackers with low privileges to exfiltrate the admission controller's ServiceAccount token. By directing `apiCall` requests to external or attacker-controlled endpoints, the token is automatically attached without explicit authorization headers. This unauthorized access can lead to attackers gaining full control over Kyverno policies and cluster resources.
Statement: This is an Important vulnerability in Kyverno, affecting Red Hat Konflux, where a low-privileged attacker can exfiltrate the admission controller's ServiceAccount token. This occurs because Kyverno automatically attaches the tok
No detection rules found.
No public exploits indexed.
2026-09-01
Published