Kyverno: policy Service Call resolves external addresses and ships policy context off-cluster

Impact

Service Call is documented for reaching in-cluster services, but it also resolves external addresses, so a policy author can point it at a server they control. Kyverno sends policy context data with the request, and that context can include the contents of Kubernetes resources such as secrets - so this is a straightforward exfiltration channel rather than a probe. On a shared GPU cluster the secrets in reach are the ones that matter operationally: registry pull credentials, object-store keys for model and dataset buckets, and whatever the evaluated resources carry. This is the older of two Kyverno SSRF issues in this sweep; see also CVE-2026-84199, which adds the confused-deputy read-back path.

Who can reach it

Anyone with rights to create Kyverno (Cluster)Policy objects - typically a platform or tenant admin, not an unprivileged workload. Exfiltration additionally requires that the Kyverno pod can reach the attacker's host, so egress-restricted clusters blunt it.

What to do

Upgrade Kyverno to v1.13.4 or later. This rolls the admission controller Deployment - a daemon restart, no node drain or reboot - with a possible short admission gap if failurePolicy is Fail. Until the upgrade lands, restrict egress from the Kyverno namespace to in-cluster destinations and audit existing policies for apiCall/service entries pointing outside the cluster.

References

Related entries

• Kata Containers: A malicious host can circumvent guest protectionsCVE-2025-58354 · Kata ContainersMedium
• containerd: CRI Attach implementation bug lets a user attach to a container they should not reachCVE-2025-64329 · containerdMedium
• KubeVirt: virt-handler service-account permissions (update VMI, patch nodes) can be abused to force VMI migrationCVE-2025-64436 · KubeVirtMedium
• Contrast: malicious host supplies a null-cipher LUKS2 volume, so guest secrets are written in plaintextCVE-2025-71422 · Contrast (confidential-containers Kubernetes runtime, Initializer secure persistent volume / LUKS2 handling)Medium
• Docker Buildx Bake: untrusted Bake definition reads files outside the project without approvalCVE-2026-103433 · Docker Buildx Bake (fs.read entitlement validation)Medium
• Crossplane runtime: time-of-check/time-of-use in xpkg ImageConfig resolutionCVE-2026-105163 · Crossplane crossplane-runtime (xpkg client ImageConfig lookup)Medium