Kyverno: legacy apiCall path skips the egress blocklist, allowing SSRF to cloud metadata from the admission controller

Impact

The egress blocklist (link-local metadata, loopback) and the scoped-token control were only wired into the new CEL http.Get/Post library, so every non-CEL context[].apiCall.service call and every GlobalContextEntry external-API call still uses a plain HTTP client with no destination filtering. A policy author - or, where a deployed policy templates the service URL from the admission resource, a lower-privileged user who can submit that resource - makes the admission controller fetch arbitrary hosts from its own network position: the node's cloud metadata endpoint, loopback services, and any in-cluster service that trusts the cluster network. On a GPU cluster the admission controller usually runs on a control-plane node with an instance role that can reach the cloud API, so the payoff is instance credentials plus a probe of internal endpoints. Kyverno also attaches its projected ServiceAccount token to the attacker-chosen destination, though that token is audience-scoped and of limited replay value.

Who can reach it

Authenticated Kubernetes user able to create or modify a ClusterPolicy or GlobalContextEntry; where a policy templates the service URL from the admitted resource, any user who can submit that resource.

What to do

Upgrade Kyverno to 1.19.1 and roll the admission controller deployment - a rolling restart of the Kyverno pods, no node disruption and no GPU workload impact. Until then, audit ClusterPolicy and GlobalContextEntry objects for apiCall.service entries whose URL is templated from request data, and restrict who can create policy objects.

References

Related entries

• Kyverno: percent-encoded dot-segments in apiCall urlPath bypass namespace scoping in namespaced PoliciesCVE-2026-100707 · Kyverno admission controller (namespaced Policy apiCall urlPath validation)High
• Kyverno: self-referential variable templates hang the admission webhook, blocking cluster-wide admissionCVE-2026-122305 · Kyverno admission controller (variable substitution)High
• Kyverno: pathological wildcard patterns in policy match/exclude names pin admission controller coresCVE-2026-122306 · Kyverno admission controller (ValidateMatchExcludeConflict wildcard matching)High
• Kyverno: namespaced PolicyExceptions fold into generated ValidatingAdmissionPolicies, bypassing enforcementCVE-2026-122307 · Kyverno admissionpolicygenerator controller (PolicyException handling)High
• Kyverno: APICall URLPath query string defeats the namespace regex, reading cluster-scoped resourcesCVE-2026-122312 · Kyverno APICall Fetch() (pkg/engine/apicall/apiCall.go URLPath validation)High
• Kyverno: templated generate.clone namespace copies another tenant's ConfigMaps into the attacker's namespaceCVE-2026-122320 · Kyverno background controller (generate.clone / cloneList namespace templating)High