Database/Container, Kubernetes & orchestration
Kyverno: apiCall sends the admission controller ServiceAccount token to any URL a policy names
Impact
Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests, and the service URL is not validated, so it can point at an attacker-controlled server. That ServiceAccount can patch webhook configurations, so a captured token leads to full cluster compromise. On a shared GPU cluster that means control over every workload and node the cluster schedules, including other tenants' training and inference jobs.
Who can reach it
Authenticated user who can create or modify a ClusterPolicy (CVSS PR:H), plus a network endpoint the Kyverno admission controller can reach. No user interaction needed.
What to do
Upgrade Kyverno to 1.16.4, 1.17.2-rc1 or 1.18.0-rc1, which roll the Kyverno controller deployments with no node drain. Until then, limit who can create or edit ClusterPolicy objects, check existing policies for apiCall entries that point at unexpected URLs, and rotate the admission controller ServiceAccount token if any are found.
References
Related entries
- Envoy Gateway: path-normalization gap in the Lua validator lets submitted Lua read controller pod filesCVE-2026-53713 · Envoy Gateway controller (Lua validator, EnvoyExtensionPolicy)Critical
- Argo CD Image Updater: ImageUpdater resource crosses namespaces to update other tenants' appsCVE-2026-6388 · Argo CD Image Updater (ImageUpdater resource namespace validation)Critical
- Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical
- Argo CD: Improper authorization causes the API to accept tokens it should rejectCVE-2023-22482 · Argo CDCritical
- AKS Confidential Containers: elevation of privilege across the confidential container boundaryCVE-2024-21400 · Azure Kubernetes Service Confidential Containers (az confcom tooling)Critical
- Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against adminsCVE-2024-28175 · Argo CDCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.