CVE-2026-100705: 
Kyverno Analyse et atténuation des vulnérabilités

CVE-2026-100705 is a Server-Side Request Forgery (SSRF) vulnerability in Kyverno, a Kubernetes admission controller, affecting all versions before 1.19.1. The flaw allows ClusterPolicy or GlobalContextEntry authors — and in some configurations, lower-privileged resource submitters — to cause Kyverno to issue arbitrary outbound HTTP requests, including to cloud metadata endpoints and internal cluster services. It was published on September 26, 2026, with a fix available in version 1.19.1. The vulnerability carries a CVSS v3.1 score of 7.6 (High) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Kyverno Advisory).

The root cause (CWE-918) is an incomplete fix: in April 2026, Kyverno's maintainers added an egress blocklist (covering 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and a scoped ServiceAccount token control, but these were wired exclusively into the new CEL http.Get/Post library (pkg/cel/compiler/http.go) and never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or the GlobalContextEntry external-API path. The legacy executor uses a bare &http.Client{Timeout: timeout} with no egress filtering, accepts the raw attacker-controlled Service.URL without validation, and unconditionally attaches Kyverno's projected ServiceAccount Bearer token to any destination. Additionally, when a deployed policy templates the service URL from the admission resource via SubstituteAllInType, a lower-privileged resource submitter can control the egress target, and the GlobalContextEntry path bypasses even the namespaced-policy URL guard by calling Execute directly (Kyverno Advisory).

Successful exploitation allows an attacker to read cloud instance credentials (e.g., AWS/GCP IAM credentials from 169.254.169.254), access internal cluster services using Kyverno's privileged network position, and exfiltrate Kyverno's projected ServiceAccount token to an attacker-controlled host. The SSRF is non-blind — response bodies are returned into the policy context or GlobalContextEntry data, enabling direct data exfiltration. POST requests are also supported, enabling limited write operations or side-effect requests to internal endpoints. Availability is not directly impacted, but confidentiality impact is rated High and integrity impact Low (Kyverno Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. Exploitation requires High privileges (ClusterPolicy or GlobalContextEntry authoring rights) in the base case, though the amplifier case reduces this requirement to any user who can submit a resource matched by a policy that templates its service URL from the admission object. The vulnerability is not listed in the CISA KEV catalog. No EPSS score or threat actor attribution is currently available (GitHub Advisory, Kyverno Advisory).

1. Identify target: Confirm the target Kubernetes cluster is running Kyverno < 1.19.1 with the legacy apiCall.service executor enabled (default configuration; no feature flag required).
2. Obtain policy-authoring privileges: Acquire ClusterPolicy or GlobalContextEntry creation rights (cluster-scoped RBAC), or identify an existing deployed policy that templates service.url from the admission resource (amplifier path).
3. Craft malicious ClusterPolicy or GlobalContextEntry: Author a policy with context[].apiCall.service.url pointing to the cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) or an internal cluster service URL.
4. Trigger policy evaluation: Create or update a Kubernetes resource that matches the policy's rules, causing Kyverno's admission webhook to evaluate the policy and invoke the legacy service executor.
5. Retrieve exfiltrated data: The legacy executor issues a GET/POST to the attacker-specified URL with no egress filtering, attaches Kyverno's projected ServiceAccount Bearer token, and returns the response body into the policy context — delivering cloud IAM credentials or internal service data to the attacker.
6. Amplifier variant: If a deployed policy templates service.url from {{ request.object.* }}, submit a crafted resource as a lower-privileged user to redirect Kyverno's outbound request to an attacker-controlled host and capture the leaked SA token (Kyverno Advisory).

• Network: Outbound HTTP/HTTPS requests from the Kyverno pod to 169.254.169.254, 169.254.169.253, 127.0.0.1, or unexpected external hosts; requests carrying Authorization: Bearer headers to non-Kubernetes-API destinations.
• Logs: Kyverno controller logs showing apiCall service executor invocations with unusual or external service.url values; HTTP responses from metadata endpoints appearing in policy context evaluation logs.
• Kubernetes Audit Logs: Creation or modification of ClusterPolicy or GlobalContextEntry resources with context[].apiCall.service.url fields pointing to RFC-1918, loopback, or link-local addresses; unexpected resource submissions by low-privileged users triggering policies with templated service URLs.
• Process/Runtime: Unexpected network connections originating from the kyverno container process to cloud metadata IP ranges (169.254.0.0/16) or internal cluster service IPs (Kyverno Advisory).

Upgrade Kyverno to version 1.19.1 or later, which applies the SSRF egress blocklist and scoped-token controls to the legacy apiCall service executor and GlobalContextEntry external-API path. As an interim workaround, restrict ClusterPolicy and GlobalContextEntry creation/modification rights to trusted administrators only via RBAC, and audit existing policies for any that template service.url from admission resource fields. Review all context[].apiCall.service and GlobalContextEntry configurations for external or metadata-endpoint URLs and remove or restrict them (Kyverno Advisory, GitHub Advisory).

The advisory was published by Kyverno maintainer realshuting on September 10, 2026, and credited researcher ttzero25 as the reporter. The vulnerability was characterized as an incomplete fix of prior SSRF advisories, specifically noting that the April 2026 blocklist commit (5c1e65aac) left the legacy executor unguarded while annotating only the CEL client as SSRF-mitigated. No significant broader media coverage or social media discussion has been identified at this time (Kyverno Advisory).