Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker‑controlled endpoints, providing an attacker an unrestricted bearer token to authenticate against the Kubernetes API. With that token an attacker can fully control Kyverno policies and the entire cluster.

The Kyverno policy engine. All deployments running Kyverno versions earlier than 1.16.4 are potentially affected. The advisory lists only Kyverno as the product and indicates that any version prior to 1.16.4 will automatically attach the ServiceAccount token when operating in apiCall service mode.

The CVSS score of 8.3 indicates high severity. The EPSS score is less than 1%, reflecting a low probability that the vulnerability will be exploited. The vulnerability is not listed in CISA KEV. Attackers can leverage the automatic token attachment to exfiltrate a bearer token by configuring an apiCall request to point to an external or attacker‑controlled endpoint. With the stolen token, an attacker can authenticate as the Kyverno service account and obtain unrestricted access to the Kubernetes cluster, including the ability to modify policies and resources. The scope of impact is the entire cluster where the affected Kyverno instance runs.