CVE-2025-15613: falha de média gravidade em kyverno
Kyverno before v1.13.4 SSRF via Service Call
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Produtos afetados
kyverno · kyvernoCVEs relacionadas — kyverno
No mesmo produto, das mais perigosas para as menos.
CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.8%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42813MEDIUMDenial of service from malicious manifest in kyvernoEPSS 0.7%CVE-2026-23881HIGHKyverno Denial of Service via Context Variable Amplification in Policy EngineEPSS 0.6%CVE-2026-100706CRITICALkyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPathEPSS 0.6%