CVE-2026-4789

CVE-2026-4789

View on CVE.org
Published Mar 30, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.

Analysis

AI-generated

Technical impact

Kyverno and its associated policies are exposed to a Server Side Request Forgery (SSRF) flaw caused by unrestricted CEL HTTP functions. The vulnerability allows an attacker to instruct Kyverno to issue HTTP requests to arbitrary hosts from within the cluster, potentially accessing internal resources or sensitive information. The weakness is categorized as CWE‑918.

Affected Systems

All Kyverno deployments running version 1.16.0 or newer are affected. The issue exists in any installation that includes the relevant CEL HTTP function code and does not have a patch that mitigates the flaw.

Risk and Exploitability

The severity rating of 9.8 places the flaw in the critical range. The EPSS score indicates that exploitation attempts are currently rare, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is when an attacker can submit or modify policy rules that invoke the CEL HTTP function, though the specific prerequisites are not disclosed in the CVE data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Kyverno to the latest release that fixes the SSRF vulnerability.
  • Restrict inbound access to the Kyverno API so only trusted users or service accounts can submit policies.
  • Apply network segmentation or firewall rules to prevent Kyverno pods from making outbound HTTP requests to internal networks.
  • If immediate upgrade is not possible, disable or limit CEL HTTP functions within Kyverno’s configuration.
  • Monitor Kyverno logs for unexpected outbound HTTP requests.

Generated by OpenCVE AI on April 3, 2026 at 21:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-qqrv-2hch-83q4 Kyverno is vulnerable to server-side request forgery (SSRF)
Github GHSA Github GHSA GHSA-rggm-jjmc-3394 Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
History
Type Values Removed Values Added
CPEs cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Weaknesses CWE-918
Type Values Removed Values Added
Weaknesses CWE-918
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Kyverno
Kyverno kyverno
Weaknesses CWE-918
Vendors & Products Kyverno
Kyverno kyverno
Type Values Removed Values Added
Description Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.
Title CVE-2026-4789
References
Earlier changes (1)
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Apr 1, 2026, 6:43 PM
Reserved
Mar 24, 2026, 8:03 PM

View source JSON

Updated
Mar 30, 2026, 9:18 PM

JSON

Status
Analyzed
Published
Mar 30, 2026, 9:17 PM
Modified
Jun 17, 2026, 10:57 AM

View source JSON

No data.

Updated
Apr 7, 2026, 8:08 AM

JSON