Server-Side Request Forgery in Kyverno Before 1.16.2

CVE-2026-84199

What is CVE-2026-84199?

Kyverno versions prior to 1.16.2 are susceptible to a server-side request forgery vulnerability within the APICall feature. This flaw arises from the lack of validation on the URL field in a Policy's ServiceCall configuration. An attacker with namespace-level Policy creation permissions can manipulate this configuration to instruct Kyverno to make unauthorized HTTP requests to internal resources, including sensitive cloud metadata endpoints or resources belonging to other tenants. Consequently, since Kyverno operates with a high-privilege ServiceAccount, the responses containing critical information, such as other tenants' secrets or cloud IAM credentials, can be retrieved, thereby breaching the expected multi-tenant isolation and raising significant security concerns.

References