CVE-2026-41323
HIGHKyverno: ServiceAccount token leaked to external servers via apiCall service URL
Title source: cnaDescription
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has no validation — it can point anywhere, including attacker-controlled servers. Since the admission controller SA has permissions to patch webhook configurations, a stolen token leads to full cluster compromise. Versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4 patch the issue.
Scores
CVSS v3
8.1
EPSS
0.0002
EPSS Percentile
5.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-200
CWE-918
Status
published
Products (2)
kyverno/kyverno
< 1.16.4
kyverno/kyverno
>= 1.17.0-rc1, < 1.17.2-rc1
Published
Apr 24, 2026
Tracked Since
Apr 24, 2026