Database/Container, Kubernetes & orchestration
Kyverno: apiCall servicecall leaks the controller service account token to policy-chosen URLs
Impact
When a policy's apiCall servicecall does not set an Authorization header, Kyverno adds the controller's own service account bearer token to the request. The policy controls the target URL, so anyone who can write a ClusterPolicy or global context entry can send that token to an endpoint they control. They then act as the Kyverno controller, which usually holds broad cluster-wide permissions so it can validate, mutate and generate resources. That turns limited policy-authoring rights into control over a shared GPU cluster. Namespaced policies cannot use servicecall, so the exposure is limited to ClusterPolicy and global context.
Who can reach it
An authenticated Kubernetes user with permission to create or modify a Kyverno ClusterPolicy or global context entry. Tenants with namespace-only policy rights are not affected.
What to do
Upgrade Kyverno to 1.16.4 or later, which is a rolling restart of the Kyverno controller deployments. Audit who has write access to ClusterPolicy and global context resources, and review existing policies for apiCall service URLs that point outside the cluster. If a leak is suspected, rotate the Kyverno service account token.
References
Related entries
- Contour: HTTPProxy cookie rewrite policy injects Lua that runs inside the shared Envoy proxyCVE-2026-41246 · Contour ingress controller (cookie rewriting via Envoy HTTP Lua filter)High
- Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path): The first fix forCVE-2026-42296 · Argo Workflows (controller, hostNetwork / securityContext / serviceAccountName merge path)High
- etcd: revoked client certificates still authenticate on the gRPC listener when HTTP and gRPC are splitCVE-2026-59818 · etcd (gRPC client listener with --listen-client-http-urls, --client-crl-file enforcement)High
- containerd: On SELinux hosts, an unprivileged pod with a hostPath volume can gain full read/write to the host filesystemCVE-2021-43816 · containerdHigh
- Cilium: IPsec transparent encryption is cryptographically ineffectiveCVE-2024-28860 · CiliumHigh
- CRI-O: untrusted checkpoint archive on restore allows unintended host filesystem operationsCVE-2026-15801 · CRI-O (container checkpoint/restore metadata validation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.