Vulnerability in Kyverno Policy Engine Exposes Cluster Security
CVE-2026-41323
8.1HIGH
What is CVE-2026-41323?
The Kyverno policy engine has a vulnerability in its apiCall feature that automatically sends the admission controller's ServiceAccount token with outgoing HTTP requests. This occurs without any validation on the service URL, allowing it to direct requests to potentially malicious servers. If an attacker can intercept this token, they gain unauthorized access and permissions to manipulate webhook configurations, which leads to the risk of full cluster compromise. Users are encouraged to upgrade to versions 1.18.0-rc1, 1.17.2-rc1, or 1.16.4 to mitigate this risk.
Affected Version(s)
kyverno < 1.16.4 < 1.16.4
kyverno >= 1.17.0-rc1, < 1.17.2-rc1 < 1.17.0-rc1, 1.17.2-rc1