CVE-2026-84196: high-severity vulnerability in kyverno
Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 0.4%
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
kyverno · kyvernoRelated CVEs — kyverno
In the same product, most dangerous first.
CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.8%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42813MEDIUMDenial of service from malicious manifest in kyvernoEPSS 0.7%CVE-2026-23881HIGHKyverno Denial of Service via Context Variable Amplification in Policy EngineEPSS 0.6%CVE-2026-100706CRITICALkyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPathEPSS 0.6%