Kyverno versions prior to 1.18.0 contain a server‑side request forgery flaw in the apiCall.service.url parameter. An authenticated user can inject arbitrary input through variable substitution, causing Kyverno to send arbitrary HTTP requests to internal endpoints. The responses from those requests are reflected in admission error messages, allowing attackers to read information from internal or cloud metadata services without needing to be blind.

Any installation of Kyverno prior to version 1.18.0 is affected. In practice this means Kyverno 1.17.x and earlier running on any Kubernetes cluster or standalone environment that has the apiCall feature enabled.

The CVSS score of 8.3 indicates high severity, and the EPSS score is not available, but the lack of availability does not reduce the risk of exploitation. Kyverno is not listed in CISA’s KEV catalog, yet the vulnerability’s access requirements—authentication and use of the apiCall API—are commonly met by cluster administrators or users with elevated privileges. An attacker who authenticates can target internal services, cloud metadata endpoints, or loopback addresses, and because request responses are exposed in error messages, non‑blind data exfiltration becomes feasible, which can serve as a foothold for further lateral movement, credential leakage, or denial‑of‑service actions.