CVE-2026-84196
Received Received - Intake

Kyverno SSRF via apiCall.service.url Variable Substitution

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84196
EUVD
EUVD-2026-69033

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno to 1.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84196 is a Server-Side Request Forgery (SSRF) vulnerability in Kyverno versions before 1.18.0. It allows authenticated users to inject malicious input through variable substitution in the apiCall.service.url component, enabling arbitrary HTTP requests to internal services, cloud metadata endpoints, or loopback addresses. The response data from these requests is reflected in admission error messages, allowing non-blind data exfiltration.

Detection Guidance

To detect this vulnerability, check Kyverno versions before 1.18.0 using commands like 'kyverno version' or 'kubectl get pods -n kyverno -o yaml | grep image'. Inspect ClusterPolicies for apiCall.service.url usage with variable substitution. Monitor admission error messages for unexpected HTTP request responses from internal services or cloud metadata endpoints.

Impact Analysis

This vulnerability allows attackers to send unauthorized HTTP requests from a privileged network position, potentially accessing sensitive internal services or cloud metadata. Exposed data could include secrets, configuration details, or other confidential information. The impact includes data breaches, unauthorized access to internal systems, and potential compromise of Kubernetes clusters.

Compliance Impact

This vulnerability could lead to violations of GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately upgrade Kyverno to version 1.18.0 or later. Review and remove any ClusterPolicies using apiCall.service.url with variable substitution. Implement network policies to restrict access to internal services and cloud metadata endpoints. Monitor admission controller logs for suspicious HTTP requests targeting loopback or internal addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart