Kyverno’s apiCall feature, before the release of 1.18.0‑rc1, 1.17.2‑rc1, and 1.16.4, automatically attaches the admission controller’s ServiceAccount token to outgoing HTTP requests. The configured service URL is not validated and may point to any host, including attacker‑controlled ones. If an attacker can supply an arbitrary URL, they can exfiltrate the ServiceAccount token. With that token, the attacker can patch webhook configurations, effectively taking control of the entire Kubernetes cluster. This flaw is a confidentiality and authentication breach (CWE‑200) that can lead to privilege escalation.

Kyverno versions prior to 1.18.0‑rc1, 1.17.2‑rc1, and 1.16.4 are vulnerable. The vulnerability affects the Kyverno policy engine deployed on Kubernetes clusters that use the apiCall feature in ClusterPolicy objects.

The CVSS score of 8.1 indicates a high severity, yet the EPSS score of less than 1% suggests that exploitation is considered unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker crafting a ClusterPolicy that directs an apiCall to an attacker‑controlled server to capture the ServiceAccount token. After obtaining the token, the attacker can use it to patch cluster webhook configurations, achieving full cluster compromise. Given the high impact and the availability of a patch, the risk warrants immediate action.