Kyverno versions before 1.16.4 automatically attach the admission controller’s ServiceAccount token to outbound HTTP requests when operating in apiCall service mode. This behavior occurs without explicit authorization headers, allowing an attacker to intercept and exfiltrate the bearer token from the request. The leaked token can be used to authenticate against the Kubernetes API and obtain unrestricted access to cluster resources and Kyverno policies. The underlying weakness corresponds to Improper Authorization (CWE-200).

The vulnerability affects the Kyverno project, specifically the Kyverno policy engine. All deployments running Kyverno prior to version 1.16.4 are potentially affected. The advisory lists no additional vendor or product variations.

The CVSS score of 8.3 categorizes this flaw as high severity. The EPSS score is not available, so the present likelihood of exploitation cannot be quantified, but the flaw is publicly referenced and can be leveraged by an attacker who can influence apiCall requests. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to either inject malicious policies that trigger apiCall or otherwise direct apiCall requests to an external service they control, thereby extracting the ServiceAccount token. Once extracted, the token grants the attacker the same privileges as the Kyverno pod, which can lead to arbitrary policy changes or full cluster takeover. The scope of impact, therefore, is the entire Kubernetes cluster running the affected Kyverno instance.