CVE-2025-15613: Kyverno before v1.13.4 SSRF via Service Call
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kyvernoto a version that resolves this vulnerability.Fixed in v1.13.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to create Kyverno Policies or ClusterPolicies. They can configure an apiCall/service target using an external URL under their control.
What data could be exposed through the forged request?
Policy context data is sent in Service Call requests. This can include the contents of Kubernetes resources such as secrets, potentially allowing sensitive cluster data to be exfiltrated.
Are deployments using Service Call limited to in-cluster services protected by that intended usage?
No. Although Service Call is documented for in-cluster services, affected Kyverno versions can resolve external addresses specified in a policy configuration.
What version remediates the issue?
Upgrade Kyverno to version 1.13.4 or later. Versions before 1.13.4 are affected.