Kyverno, prior to version 1.19.1, processes external service calls through a legacy executor that omits the egress blocklist and scoped‑token control implemented for newer CEL‑based calls. This flaw allows a policy author or a lower‑privileged resource submitter to trigger Kyverno to perform HTTP GET or POST requests to any audience‑specified URL, including cloud metadata endpoints, loopback interfaces, or arbitrary in‑cluster services. The request is sent with Kyverno’s projected ServiceAccount token, which grants the service access to cluster resources. Because Kyverno’s network position is per‑pod, the attacker can read cloud instance credentials or reach internal endpoints that might otherwise be unreachable.

All Kyverno installations with versions earlier than 1.19.1 are affected. The vulnerability surfaces when a ClusterPolicy or GlobalContextEntry contains an external‑API call that is not written in CEL, or when a policy templates the service URL from an admission resource.

The CVSS score of 8.3 indicates a high‑severity flaw. The EPSS score is not available, but the lack of egress filtering and the automatic attachment of a ServiceAccount token greatly increase the attack surface. The vulnerability is not included in the CISA KEV catalog at this time. Exploitation requires an attacker to write or modify a policy (or to submit a resource that is processed by a policy), then specify a malicious destination URL. Once the request is issued, the attacker can retrieve data from the target endpoint or use the token for further internal access.