CVE-2026-84199
published 2026-09-01CVE-2026-84199: Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration…
PriorityP351high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.36%
29.2th percentile
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants' resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants' secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kyverno | kyverno | < 1.16.2 | 1.16.2 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/kyverno/kyverno: Kyverno: Information Disclosure via Server-Side Request Forgery in APICall Feature
vendor_redhat·2026-09-01·CVSS 7.7
CVE-2026-84199 [HIGH] CWE-918 github.com/kyverno/kyverno: Kyverno: Information Disclosure via Server-Side Request Forgery in APICall Feature
github.com/kyverno/kyverno: Kyverno: Information Disclosure via Server-Side Request Forgery in APICall Feature
A flaw was found in Kyverno. A Server-Side Request Forgery (SSRF) vulnerability exists in the APICall feature due to improper validation of the URL field in a Policy's ServiceCall configuration. A user with namespace-level Policy creation permissions can exploit this to direct Kyverno to make HTTP requests to arbitrary internal resources. This allows the attacker to access sensitive information, such as cloud metadata endpoints or other tenants' secrets and cloud IAM credentials, breaking multi-tenant isolation.
Statement: Important: Kyverno in Konflux is vulnerable to information disclosure via Server-Side Request Forgery. A user with namespace-level policy creation permissions
GHSA
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature.
ghsa_unreviewed·2026-09-01
CVE-2026-84199 [MEDIUM] CWE-918 Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature.
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants' resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants' secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.
No detection rules found.
No public exploits indexed.
2026-09-01
Published