EUVD-2025-210816
GHSA-8g8h-v9pm-r6xg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ClusterPolicy creation requires an explicit RBAC grant (PR:L); data exfiltration crosses cluster boundary to external server (S:C); Kubernetes Secrets fully exposed to attacker (C:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.
AnalysisAI
Server-side request forgery in Kyverno's Service Call feature (versions before v1.13.4) allows any cluster user holding ClusterPolicy creation rights to exfiltrate arbitrary Kubernetes resource data - including Secrets - by directing policy apiCall requests to an attacker-controlled external server. The vulnerability stems from a missing URL validation that permits the apiCall/service block, documented for in-cluster services, to resolve and POST data to internet-accessible endpoints. Publicly available exploit code exists in the form of a working PoC ClusterPolicy published in the GHSA advisory; no active exploitation is confirmed via CISA KEV.
Technical ContextAI
Kyverno is a Kubernetes-native admission policy engine (CPE: cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*) that evaluates custom resource definitions - Policy and ClusterPolicy - against API server admission events via a mutating/validating webhook. Its external data source feature includes a Service Call mode (spec.rules[].context[].apiCall.service) intended to query in-cluster HTTP services and inject their responses as policy context variables. CWE-918 (Server-Side Request Forgery) describes the root cause: the Kyverno controller performs outbound HTTP requests to any URL specified in the service.url field without restricting targets to RFC 1918 or cluster-internal addresses. Because the request body contains the full policy evaluation context - including the resource under admission review - any field resolved at evaluation time (namespace, labels, resource contents) is transmitted verbatim to the attacker-specified endpoint.
RemediationAI
Per the CVE description, upgrading to Kyverno v1.13.4 or later is the primary fix; consult https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq to confirm the released patch version before deploying, given the conflicting package-level data. Where patching is not immediately possible, apply the following targeted compensating controls: first, restrict ClusterPolicy and Policy creation rights in Kubernetes RBAC to only cluster-admin-equivalent principals or a tightly scoped CI service account, removing any developer-level policy creation grants (trade-off: this blocks legitimate self-service policy workflows). Second, audit all existing policies for malicious apiCall/service blocks using kubectl get clusterpolicies,policies -A -o json | jq '.items[].spec.rules[].context[]?.apiCall.service // empty' and remove or quarantine any referencing external URLs. Third, if the Kyverno controller's network egress can be restricted via Kubernetes NetworkPolicy or an egress firewall, block outbound connections from the kyverno namespace to non-RFC-1918 addresses (trade-off: this also blocks legitimate external apiCall integrations if any are in use).
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today