Authorization Injection Vulnerability in Kyverno Policy Engine
CVE-2026-40868

8.1HIGH

Key Information:

Vendor

Kyverno

Status
Kyverno
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40868?

Kyverno, a policy engine for cloud-native environments, contains a vulnerability in its apiCall servicecall helper that allows implicit injection of the Authorization header. When a policy fails to define an Authorization header, the kyverno controller’s service account token can be sent to attacker-controlled endpoints. This poses a significant security risk, particularly for ClusterPolicy and global context use, as the service account token could grant unauthorized access. Users are advised to upgrade to version 1.16.4 or later to mitigate this risk.

Affected Version(s)

kyverno < 1.16.4

References

https://github.com/kyverno/kyverno/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.