Kyverno CVE-2026-100705

Exploitation requires the ability to author a Kyverno ClusterPolicy or GlobalContextEntry that uses a non-CEL context[].apiCall.service call (the legacy apiCall service executor path), which is a cluster-privileged operation (PR:H). The egress blocklist and scoped-token control were only wired into the new CEL http.Get/Post library, so any policy using the legacy service executor or the GlobalContextEntry external-API path is affected on versions before 1.19.1. A limiting factor: in the default case the attacker must already hold policy-authoring privileges. The privilege bar drops to a lower-privileged resource submitter ONLY when a deployed policy templates the service URL from the admission resource - a non-default, deployment-specific configuration. The stolen ServiceAccount token is audience-scoped, limiting its replay value.

The vendor CVSS 4.0 score of 8.3 (High) reflects a network-exploitable (AV:N), low-complexity (AC:L), no-user-interaction SSRF with high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H) via cloud metadata credential theft. Crucially, the vector requires high privileges (PR:H), consistent with the description: the primary attacker is a ClusterPolicy or GlobalContextEntry author, who is inherently a trusted, cluster-privileged actor. This substantially lowers real-world risk versus an unauthenticated flaw. The description does note a lower-privilege escalation path - where a deployed policy templates the service URL from the admission resource, an ordinary resource submitter could trigger it - but this is deployment-dependent, not the default. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - a real but not urgently-exploited issue. The token-theft angle is partially mitigated: the exfiltrated projected ServiceAccount token is audience-scoped, limiting replay. Net: a legitimately serious SSRF-to-metadata-credential issue in a widely used Kubernetes tool, but gated behind privileged policy authorship in the default case, making it a patch-promptly rather than drop-everything priority.

A user with rights to author a Kyverno ClusterPolicy or GlobalContextEntry defines a non-CEL context[].apiCall.service call pointing at the cloud metadata endpoint (e.g. 169.254.169.254 or metadata.google.internal). Kyverno's legacy executor issues the GET/POST with no egress filtering, returning cloud instance credentials to the policy context, and even attaches Kyverno's projected ServiceAccount token to the attacker-chosen host. In deployments where a policy templates the service URL from the admission resource, a lower-privileged resource submitter can trigger the same request path. No public POC is currently identified.