GHSA-8wfp-579w-6r25
High · 7.7Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)
CVSS
7.7
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
Kyverno's apiCall service mode automatically attaches the admission controller's ServiceAccount (SA) token to outbound HTTP requests. This results in unintended credential exposure when requests are sent to external or attacker-controlled endpoints. The behavior is insecure-by-default and not documented, enabling token exfiltration without requiring policy authors to explicitly opt in. ---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200
- CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory… CWE-200
- CVE-2026-107383 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB… CWE-200
- CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. CWE-200