Kyverno CVE-2026-84199

Requires the attacker to hold the Kubernetes RBAC verb create (or update) on the policies.kyverno.io resource within at least one namespace - this is the sole prerequisite and represents a low but non-zero privilege bar. Exploitation is most impactful in multi-tenant Kubernetes environments where platform operators grant namespace-level Policy creation rights to end-users or tenants. Cloud credential theft via 169.254.169.254 additionally requires that the cluster nodes expose IMDSv1 (hop-count unrestricted) or that IMDSv2 is not enforced with a hop limit of 1 - a common configuration on older cluster deployments. Cross-tenant secret exfiltration does not require cloud IMDS access and works against any internal Kubernetes API or in-cluster service reachable from the node network. Exploitation is not possible without at least namespace-scoped Policy creation rights; cluster-admin-only environments are not meaningfully exposed beyond existing trust boundaries.

The provided CVSS 4.0 vector (score 6.9) contains a meaningful discrepancy: PR:N (no privileges required) directly contradicts the description, which explicitly requires namespace-level Policy creation permissions. This under-reports the real access bar but simultaneously obscures a more serious subsequent-system impact: SC:L in the input vector understates the confidentiality exposure - an attacker reading cloud IAM credentials or cross-tenant secrets represents a subsequent-system high-confidentiality impact (SC:H), not low. Real-world risk is therefore higher than the published score implies, particularly in multi-tenant SaaS clusters or platforms that expose namespace-level Policy creation to end-users. There is no CISA KEV listing and no public exploit code, so exploitation is not confirmed as active. EPSS data is not provided; given the low exploitation bar (single Policy YAML) and high impact in multi-tenant environments, actual priority should be elevated above the numeric score for shared clusters. Single-tenant clusters where only cluster-admins create Policies are materially less exposed.

An attacker with namespace-scoped Policy creation rights submits a Kyverno Policy whose ServiceCall URL field is set to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Kyverno evaluates the Policy using its cluster-wide ServiceAccount, issues the HTTP request, and the IAM credential JSON is embedded in the resulting PolicyReport object. The attacker queries the PolicyReport within their namespace, retrieves the cloud IAM role credentials, and uses them to escalate privileges or exfiltrate data from cloud storage outside the cluster.