Cloudanix VulnDB

GHSA-qr4g-8hrp-c4rw

High · 7.7

Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF

CVSS

7.7

EPSS

—

Published

Apr 14, 2026

CISA due date

—

The record

A Server-Side Request Forgery (SSRF) vulnerability in Kyverno allows authenticated users to induce the admission controller to send arbitrary HTTP requests to attacker-controlled endpoints. When a `ClusterPolicy` uses `apiCall.service.url` with variable substitution (e.g. `{{request.object.*}}`), user-controlled input can influence the request target. The Kyverno admission controller executes these requests from its privileged network position without enforcing any validation or network restrictions. The issue becomes **non-blind SSRF**, as response data from internal services can be reflected back to the user via admission error messages. ---

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities