A flaw was found in Kyverno. Due to missing egress network filtering in its legacy API call handler, an attacker with permission to author policies or submit templated resources can trigger Server-Side Request Forgery (SSRF). This vulnerability allows the attacker to force Kyverno to issue arbitrary network requests to restricted internal endpoints or cloud metadata services, potentially leading to the disclosure of sensitive credentials and confidential internal data.
Last checked: 2026-09-29 11:40 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-26 23:10 UTC)
Fix evidence last checked: 2026-10-13 17:15 UTC