Server-Side Request Forgery Vulnerability in Kyverno by Nirmata

CVE-2025-15613

What is CVE-2025-15613?

The Kyverno policy engine, prior to version 1.13.4, is susceptible to server-side request forgery (SSRF) through its Service Call feature. This vulnerability can be exploited by attackers with permissions to create ClusterPolicies, as they can insert external URLs into the apiCall/service configuration within a policy. Although the Service Call is intended for internal service communication, it inadvertently resolves external addresses, sending requests to potentially malicious servers. This allows the leakage of sensitive information, including Kubernetes resource data such as secrets, to an unauthorized entity.

References