Server-Side Request Forgery Vulnerability in Kyverno by Nirmata
CVE-2026-4789

9.8CRITICAL

Key Information:

Vendor

Kyverno

Status
Kyverno
Vendor
CVE Published:
30 March 2026

What is CVE-2026-4789?

Kyverno versions starting from 1.16.0 are susceptible to a server-side request forgery (SSRF) flaw. This vulnerability arises from unrestricted CEL HTTP functions that allow malicious actors to craft requests to internal or external resources, potentially leading to sensitive data exposure. Organizations using affected versions are advised to implement mitigations quickly to secure their environments against potential exploitation.

Affected Version(s)

Kyverno 1.16.0

References

https://github.com/kyverno/kyverno
https://kb.cert.org/vuls/id/655822
https://portswigger.net/web-security/ssrf

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.