Kyverno: SSRF via apiCall.service.url lets authenticated users reach internal and metadata endpoints

Impact

User-controlled input reaches apiCall.service.url through variable substitution, so an authenticated user can make the admission controller issue arbitrary HTTP requests from its own network position. Responses come back inside admission error messages, making this non-blind data exfiltration rather than a fire-and-forget SSRF. The admission controller sits inside the cluster network with a service account, so reachable targets include the kube-apiserver, internal-only services, loopback endpoints, and cloud instance metadata - the last of which commonly yields node-level cloud credentials on managed GPU clusters. On a multi-tenant GPU cluster this is a way for a tenant with namespace-level access to read control-plane-adjacent data it was never routed to.

Who can reach it

Any authenticated user who can supply input that flows into a policy's apiCall.service.url via variable substitution. Requires cluster credentials, not external network access.

What to do

Upgrade Kyverno to 1.18.0 or later and roll the admission controller Deployment. Until patched, audit policies that build apiCall.service.url from variables and pin those URLs to literal in-cluster addresses, and apply egress network policy to the Kyverno namespace so it cannot reach the metadata endpoint or arbitrary external hosts. Control-plane workload restart only; no GPU node drain required.

References

Related entries

• Kubernetes (kubelet): /debug/pprof exposed on the unauthenticated kubelet healthz portCVE-2019-11248 · Kubernetes (kubelet)High
• Envoy: JWT with an issuer absent from the provider list bypasses JWT authenticationCVE-2021-21378 · EnvoyHigh
• KubeVirt: A compromised node's virt-handler service account can be abused cluster-wideCVE-2023-26484 · KubeVirtHigh
• Envoy: Client can forge the x-envoy-original-path header and bypass JWT checksCVE-2023-27487 · EnvoyHigh
• Envoy: Mixed-case HTTP/2 schemes defeat case-sensitive internal scheme checksCVE-2023-35944 · EnvoyHigh
• Slurm: A user can modify their extended group list used by sbcast and open files with unauthorized permissionsCVE-2023-49938 · SlurmHigh