CVE-2026-100705
Received Received - Intake

Server-Side Request Forgery in Kyverno

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API path, which handle every non-CEL context[].apiCall.service call. Because these paths use a plain net/http client with no egress filtering and no validation of the configured service URL, a ClusterPolicy or GlobalContextEntry author — or, where a deployed policy templates the service URL from the admission resource, a lower-privileged resource submitter — can cause Kyverno to issue GET/POST requests to an arbitrary host, including the cloud metadata endpoint, loopback, and any in-cluster service, reading cloud instance credentials and reaching internal endpoints with Kyverno's network position. The executor also unconditionally attaches Kyverno's projected ServiceAccount token to the attacker-chosen destination; the token is audience-scoped, limiting its replay value. Fixed in 1.19.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100705
EUVD
EUVD-2026-87678

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kyverno kyverno 1.19.1
kyverno kyverno to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kyverno before version 1.19.1 has a server-side request forgery (SSRF) vulnerability. The issue occurs because the default egress blocklist for preventing unauthorized network requests was only applied to the new CEL http.Get/Post library but not to the legacy apiCall service executor or GlobalContextEntry external-API path. These unprotected paths use a plain net/http client without egress filtering or URL validation, allowing attackers to send GET/POST requests to arbitrary hosts, including cloud metadata endpoints, loopback addresses, and internal services.

Impact Analysis

This vulnerability allows an attacker with access to create or modify ClusterPolicy or GlobalContextEntry resources to make Kyverno issue requests to unintended internal or external services. This could lead to exposure of cloud instance credentials, access to internal endpoints, or unauthorized data retrieval. The attacker could also leverage Kyverno's ServiceAccount token, though its audience-scoping limits replay potential.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as cloud metadata or internal services, potentially violating data protection requirements under GDPR or HIPAA. Unauthorized network requests may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory controls requiring strict access and data protection measures.

Mitigation Strategies

Upgrade Kyverno to version 1.19.1 or later to address the server-side request forgery vulnerability. Review existing ClusterPolicy and GlobalContextEntry configurations to ensure they do not use legacy apiCall service executors or GlobalContextEntry external-API paths that bypass egress filtering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100705. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart