CVE-2026-84196: Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kyverno apiCall.service.url (Server-Side Request Forgery via apiCall)to a version that resolves this vulnerability.Fixed in 1.18.0 - Configuration
Do not allow user-controlled input to be injected into apiCall.service.url via variable substitution; ensure apiCall.service.url cannot be influenced by authenticated users.
Kyverno apiCall.service.url apiCall.service.url variable substitution / user-controlled input handling = not specified
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated and able to supply user-controlled input that reaches variable substitution in apiCall.service.url. The vulnerability does not require user interaction and can be exploited over the network.
What can an attacker access through the vulnerable request path?
The attacker can cause Kyverno to send arbitrary HTTP requests, including to internal services, cloud metadata endpoints, and loopback addresses. Response data can be reflected in admission error messages, allowing non-blind exfiltration.
Which versions are affected?
Kyverno versions before 1.18.0 are affected. Upgrading to 1.18.0 or later removes exposure from the affected version range.