PT-2026-34846 · Kyverno · Kyverno

Koreasecurity · Published 2026-04-16 · Updated 2026-04-29 · CVE-2026-41323

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.18.0 Kyverno versions prior to 1.17.2 Kyverno versions prior to 1.16.4

Description The apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. Because the service URL lacks validation, it can be directed to attacker-controlled servers. Since the admission controller ServiceAccount possesses permissions to patch webhook configurations, the theft of this token can result in full cluster compromise.

Recommendations Update to version 1.18.0 or newer. Update to version 1.17.2 or newer. Update to version 1.16.4 or newer. Rotate ServiceAccount tokens.

Exploit

Fix

SSRF

Information Disclosure

Weakness Enumeration

CWE-918

CWE-200

Related Identifiers

BIT-KYVERNO-2026-41323

CVE-2026-41323

GHSA-F9G8-6PPC-PQQ4

Affected Products

Kyverno

References · 10

• 🔥 https://github.com/kyverno/kyverno/security/advisories/GHSA-f9g8-6ppc-pqq4 · Exploit
• https://github.com/kyverno/kyverno/commit/f70e8ac1e7acd2e3844f9553e4a884f07f953de0 · Patch
• https://github.com/kyverno/kyverno/commit/bc4f91c4801b1eaa2edc0a14e2f1b0af8cf0c1f5 · Patch
• https://github.com/kyverno/kyverno/commit/c2eab00033e635bda4e4efb58c1b472b41728bb6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41323 · Security Note
• https://osv.dev/vulnerability/BIT-kyverno-2026-41323 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f9g8-6ppc-pqq4 · Vendor Advisory
• https://github.com/kyverno/kyverno · Note
• https://twitter.com/CVEnew/status/2048099322693050796 · Twitter Post
• https://twitter.com/vulert_official/status/2049389495443955824 · Twitter Post