CVE-2026-84195
Received Received - Intake

Kyverno ServiceAccount Token Exposure via apiCall Service Mode

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84195
EUVD
EUVD-2026-69032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno to 1.16.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kyverno before version 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.

Detection Guidance

To detect this vulnerability, check Kyverno versions prior to 1.16.4 using kubectl get pods -n kyverno -l app=kyverno -o jsonpath='{.items[*].spec.containers[0].image}'. Look for apiCall usage in policies by inspecting Kyverno ClusterPolicies for apiCall actions without explicit Authorization headers.

Impact Analysis

Attackers can steal the ServiceAccount token and gain full control over Kyverno policies and cluster resources. This allows privilege escalation, webhook manipulation, and unauthorized access to sensitive data or systems within the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, and failure to meet regulatory controls.

Mitigation Strategies

Upgrade Kyverno to version 1.16.4 or later immediately. Disable apiCall service mode if not required. Review all policies using apiCall to ensure explicit Authorization headers are set. Rotate the Kyverno admission controller ServiceAccount token as a precaution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart