Kyverno versions before 1.16.2 allow an attacker who can create policies in a namespace to supply an arbitrary URL in a ServiceCall configuration. Because Kyverno validates this URL field poorly, the pod that runs the policy can make HTTP requests to any internal network address. The requests are executed with a cluster‑wide high‑privilege ServiceAccount, representing a Confused Deputy situation. The responses, which may contain sensitive data such as other tenants’ secrets or cloud metadata, are returned in the PolicyReport and can be read by the attacker, thereby breaking multi‑tenant isolation and exposing confidential information.

All installations of Kyverno released before 1.16.2 are vulnerable. This includes any Kyverno deployment that has not been upgraded to version 1.16.2 or newer; the product is the open‑source Kyverno policy engine distributed by the Kyverno project.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have namespace‑level permission to create or modify policies, a capability that is usually granted to developers or operators. Once a malicious policy is deployed, the attacker can direct Kyverno to perform internal requests and retrieve arbitrary data, leveraging the high‑privilege service account to read data that otherwise would be restricted to the cluster admin. The attack does not require external access to the cluster network and can be performed entirely from within the cluster, making it a realistic threat for tenants that share the same Kyverno instance.