CVE-2026-84196: Kyverno SSRF Vulnerability

CVE-2026-84196 Overview

CVE-2026-84196 is a Server-Side Request Forgery (SSRF) vulnerability in Kyverno versions before 1.18.0. The flaw resides in the apiCall.service.url field, where user-controlled input flows into HTTP request construction through Kyverno's variable substitution mechanism. Authenticated users can force the Kyverno admission controller to issue arbitrary HTTP requests to internal services, cloud metadata endpoints, and loopback addresses. Response bodies are reflected in admission error messages, converting a blind SSRF into a non-blind data exfiltration primitive. The vulnerability is tracked as CWE-918.

Critical Impact
Authenticated attackers can pivot from Kyverno into the cluster's internal network and read cloud instance metadata, including IAM credentials, through reflected admission responses.

Affected Products

Kyverno policy engine versions before 1.18.0
Kubernetes clusters running Kyverno admission controllers with apiCall policies
Cloud-hosted Kubernetes environments exposing instance metadata services (IMDS)

Discovery Timeline

2026-09-01 - CVE-2026-84196 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84196

Vulnerability Analysis

Kyverno supports dynamic policy evaluation through apiCall context entries that fetch data from external or cluster-internal services. The apiCall.service.url field accepts Kyverno variable references that are substituted at admission time. Before version 1.18.0, Kyverno failed to validate or restrict the resulting URL after substitution. An authenticated user who can influence admission request attributes referenced by the policy can inject arbitrary URL components. Kyverno then issues the HTTP request from within the controller pod, which typically runs with cluster-internal network reachability. The remote response is embedded in the admission decision error message returned to the requester.

Root Cause

The root cause is missing allowlist validation on URLs constructed via variable substitution in apiCall.service.url. Variable substitution runs before URL parsing and destination checks, so attacker-controlled data determines the scheme, host, and path of the outbound request. Kyverno also propagates the raw upstream response body into admission failure messages, which removes the blindness typically associated with SSRF and gives attackers a direct read channel.

Attack Vector

The attack requires only low privileges: any authenticated Kubernetes user permitted to submit resources evaluated by an apiCall-based policy can trigger the request. Attackers target 169.254.169.254 on AWS, GCP, or Azure to retrieve instance metadata and short-lived IAM tokens. Loopback addresses reach controller-local services, and cluster-internal DNS names expose admin dashboards, etcd, or kubelet endpoints not intended for tenant access. The response is exfiltrated in the admission error returned to kubectl. See the Kyverno GitHub Security Advisory and the VulnCheck Advisory on SSRF for policy-level examples.

Detection Methods for CVE-2026-84196

Indicators of Compromise

Kyverno controller pod egress connections to 169.254.169.254, 127.0.0.1, or cluster-internal service IPs not associated with legitimate policies
Admission responses containing raw JSON or token-like strings echoed from upstream services
Unusual apiCall policy definitions with variable substitution in the service.url field submitted by non-administrative accounts

Detection Strategies

Review all installed ClusterPolicy and Policy resources for apiCall entries whose service.url contains variable references such as {{request.object...}}
Correlate Kyverno controller logs with Kubernetes audit logs to link admission requests to outbound HTTP destinations
Alert on Kyverno pod network flows to link-local, loopback, or metadata IP ranges

Monitoring Recommendations

Enable Kubernetes audit logging at RequestResponse level for admissionregistration.k8s.io and Kyverno CRDs
Deploy a NetworkPolicy that logs or blocks egress from the Kyverno namespace to 169.254.0.0/16 and RFC1918 ranges outside the cluster CIDR
Monitor admission failure messages for oversized payloads or content resembling cloud IAM credentials

How to Mitigate CVE-2026-84196

Immediate Actions Required

Upgrade Kyverno to version 1.18.0 or later across all clusters
Audit existing policies and remove or rewrite any apiCall.service.url values that consume attacker-controllable variables
Rotate any cloud IAM credentials associated with nodes running vulnerable Kyverno versions, assuming metadata exposure

Patch Information

The Kyverno maintainers fixed the vulnerability in release 1.18.0 by restricting URL construction in apiCall.service.url and hardening variable substitution paths. Consult the Kyverno GitHub Security Advisory GHSA-qr4g-8hrp-c4rw for full remediation details and the fixed version notes.

Workarounds

Apply a NetworkPolicy restricting Kyverno controller egress to only required Kubernetes API and approved external endpoints
Block Kyverno pod access to the instance metadata service by egress firewall rule or IMDSv2-only enforcement on cloud nodes
Restrict RBAC so that only trusted principals can create resources matched by policies containing apiCall context entries

bash

# Example NetworkPolicy denying Kyverno egress to metadata and loopback
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kyverno-egress-restrict
  namespace: kyverno
spec:
  podSelector: {}
  policyTypes: ["Egress"]
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.0.0/16
        - 127.0.0.0/8
EOF