EUVD-2026-17241
GHSA-qqrv-2hch-83q4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.
AnalysisAI
Kyverno versions 1.16.0 and later contain a server-side request forgery vulnerability in unrestricted CEL HTTP functions that allow attackers to make arbitrary HTTP requests from the Kyverno controller, potentially accessing internal services and metadata endpoints. The vulnerability affects Kubernetes clusters running vulnerable Kyverno versions with policies utilizing CEL-based HTTP operations, with no CVSS or EPSS data currently available to quantify severity.
Technical ContextAI
Kyverno is a Kubernetes-native policy engine that uses Common Expression Language (CEL) for policy evaluation. The vulnerability stems from insufficient input validation or authorization controls on CEL HTTP functions, which are likely implemented as part of Kyverno's policy validation framework. When policies evaluate untrusted input or user-controlled values through CEL HTTP operations, an attacker can craft policy expressions that cause the Kyverno controller to issue requests to arbitrary URLs, including internal Kubernetes API servers, cloud metadata services (AWS IMDSv1, GCP metadata), or other backend systems not intended for external access. This is a classic SSRF pattern where a trusted service (Kyverno running with elevated cluster permissions) becomes a pivot point for accessing restricted network resources.
RemediationAI
Upgrade Kyverno to a patched version released after the vulnerability disclosure; consult the official Kyverno GitHub releases and CERT advisory for the specific minimum fixed version. As an interim mitigation, restrict policy definitions to trusted authors only, disable or sandbox CEL HTTP functions if Kyverno configuration allows, implement network policies to limit outbound HTTP/HTTPS traffic from Kyverno controller pods to only necessary endpoints, and audit existing policies for suspicious HTTP operations. Additional guidance is available in the CERT advisory at https://kb.cert.org/vuls/id/655822.
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy
Kyverno is a policy engine designed for Kubernetes. Rated high severity (CVSS 8.7), this vulnerability is remotely explo
Kyverno is a policy engine designed for cloud native platform engineering teams. Rated high severity (CVSS 8.5), this vu
Kyverno versions up to 1.16.3 is affected by allocation of resources without limits or throttling (CVSS 7.7).
Kyverno is a policy engine designed for cloud native platform engineering teams. Rated medium severity (CVSS 5.8), this
Policy enforcement bypass in Kyverno v1.9.0 through v1.12.7 lets an authenticated Kubernetes user evade an enforce-mode
Kyverno is a policy engine designed for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
Credential leakage in Kyverno's apiCall service mode automatically forwards the Kubernetes admission controller's Servic
Server-side request forgery in Kyverno's Kubernetes admission controller (all versions before 1.18.0) enables any authen
Kyverno's apiCall feature automatically attaches the admission controller's ServiceAccount token to HTTP requests withou
An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a ma
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today