Kyverno CVE-2026-84196

Exploitation requires all three of the following conditions to be met simultaneously: (1) the attacker possesses a valid Kubernetes identity with permission to create or update resources of a type covered by an existing ClusterPolicy (such as Pod create rights); (2) at least one ClusterPolicy exists that configures apiCall.service.url with JMESPath variable substitution drawing from attacker-controllable resource fields - specifically annotations, labels, or spec fields the attacker can populate; and (3) the Kyverno admission controller pod has network-level reachability to the intended target (cloud metadata endpoint, internal ClusterIP service, or loopback). Clusters that have no ClusterPolicies using variable-interpolated apiCall.service.url are not exploitable through this path regardless of user privilege level. Exploitation is bounded to confidentiality impact - no write capability to internal services is gained unless a targeted service exposes unsafe state-changing GET endpoints. Redirect chains of up to 10 hops are followed without re-validation, expanding the reachable target set beyond directly addressable hosts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.3) accurately reflects the attack profile: low complexity, no special conditions, exploitable by any authenticated Kubernetes user, with high confidentiality impact extending to subsequent systems the admission controller can reach. The non-blind nature of the SSRF is the decisive risk amplifier - unlike blind SSRF where attackers must infer results from timing or DNS callbacks, here IAM credential JSON from AWS IMDS surfaces verbatim in kubectl error output, making cloud credential theft trivially automatable. The scope-changed (SC:H) metric is well-justified because the primary harm is to internal infrastructure outside the Kyverno component itself. The primary risk limiter is the prerequisite that a ClusterPolicy with variable-interpolated apiCall.service.url must exist - clusters without such policies are unexploitable through this path. No EPSS data was provided in the input, so exploitation probability cannot be quantified; however, the published PoC substantially lowers the required attacker skill. The vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at time of analysis, though the combination of a clear PoC, a well-understood technique, and high-value targets (cloud IAM credentials) represents a meaningful near-term risk for any cloud-hosted Kubernetes environment running affected Kyverno versions with relevant ClusterPolicies.

An attacker with a standard Kubernetes user account submits a Pod with the annotation target: '169.254.169.254/latest/meta-data/iam/security-credentials/' to a cluster where a ClusterPolicy uses apiCall.service.url: 'http://{{ request.object.metadata.annotations.target }}'; the admission controller fetches the AWS IMDS URL from its privileged network position and, because the response body is not valid JSON, propagates the raw IAM credential JSON in the admission error message returned to the kubectl client. A fully functional proof-of-concept demonstrating this exact flow is published in GHSA-qr4g-8hrp-c4rw, requiring no specialized tooling beyond kubectl and a valid cluster credential.