CVE-2026-84199 Overview
CVE-2026-84199 is a Server-Side Request Forgery (SSRF) vulnerability in Kyverno versions prior to 1.16.2. The flaw resides in the APICall feature, where the URL field within a Policy's ServiceCall configuration is not validated. A user holding namespace-level Policy creation permissions can coerce Kyverno into issuing HTTP requests to arbitrary internal resources, including cloud metadata endpoints such as 169.254.169.254. Kyverno performs these requests using its cluster-wide high-privilege ServiceAccount, creating a Confused Deputy condition. Responses—potentially containing other tenants' secrets and cloud IAM credentials—are returned in the PolicyReport, breaking multi-tenant isolation. The issue is tracked under [CWE-918].
Critical Impact
A namespace-scoped tenant can read cluster-wide secrets, cloud IAM credentials, and other tenants' resources through Kyverno's privileged ServiceAccount.
Affected Products
- Kyverno versions prior to 1.16.2
- Kubernetes clusters running Kyverno as an admission controller with the APICall feature enabled
- Multi-tenant Kubernetes environments delegating Policy authoring to namespace users
Discovery Timeline
- 2026-09-01 - CVE-2026-84199 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84199
Vulnerability Analysis
Kyverno's APICall declaration lets policy authors fetch external data at admission time to enrich policy decisions. The ServiceCall.URL field accepts an arbitrary URL without allow-list or destination validation. Kyverno's controller executes the HTTP request using its own cluster-wide ServiceAccount, which typically holds broad read privileges across the Kubernetes API and cloud metadata surfaces. The response body is embedded into a generated PolicyReport, which the requesting tenant can view within their own namespace. This turns the controller into a proxy for privileged reads on behalf of an unprivileged tenant.
Root Cause
The root cause is missing input validation on the URL field in the Policy's ServiceCall configuration combined with unrestricted egress from the Kyverno controller pod. Kyverno does not enforce a destination allow-list, does not block link-local ranges such as 169.254.169.254/32, and does not scope the request under the calling tenant's identity. The controller's privileged identity is reused for every APICall regardless of who authored the policy—a textbook Confused Deputy problem.
Attack Vector
An attacker with Policy creation rights in any namespace authors a Policy that declares an APICall targeting a sensitive internal endpoint, such as the cloud instance metadata service, the Kubernetes API server, or another tenant's service. Kyverno resolves and fetches the URL server-side using its cluster ServiceAccount. The response—including IAM tokens returned by IMDS or Kubernetes Secrets read via the API server—is written into a PolicyReport object the attacker can read. No cluster-admin credentials or network foothold are required.
See the Kyverno GitHub Security Advisory GHSA-fmqp-4wfc-w3v7 and the VulnCheck Advisory on SSRF for technical details.
Detection Methods for CVE-2026-84199
Indicators of Compromise
- Kyverno controller egress connections to link-local metadata addresses such as 169.254.169.254, fd00:ec2::254, or metadata.google.internal.
- PolicyReport objects containing fields that resemble cloud IAM credentials, JWT tokens, or Kubernetes Secret payloads.
- Newly created Policies whose spec.rules[].context[].apiCall.service.url references internal, link-local, or cross-tenant hostnames.
Detection Strategies
- Audit all ClusterPolicy and Policy objects for apiCall contexts and flag any URL values that are not on an approved list.
- Correlate Kyverno pod network telemetry against a deny list covering cloud metadata CIDRs, RFC1918 sensitive ranges, and the Kubernetes API server address.
- Review Kubernetes audit logs for policyreports.wgpolicyk8s.io reads by non-admin service accounts, especially soon after Policy creation events.
Monitoring Recommendations
- Ingest Kyverno controller logs and Kubernetes audit events into a centralized data lake for retroactive hunting on Policy creation and PolicyReport read patterns.
- Alert on any HTTP response body larger than expected returned from an APICall context, as exfiltrated Secrets and IAM responses tend to be verbose.
- Baseline the Kyverno controller's outbound destinations and alert on deviations to new external hosts.
How to Mitigate CVE-2026-84199
Immediate Actions Required
- Upgrade Kyverno to version 1.16.2 or later across all clusters.
- Enumerate existing Policies for apiCall.service.url entries and remove or restrict any that reference internal or metadata endpoints.
- Rotate any cloud IAM credentials and Kubernetes Secrets that Kyverno's ServiceAccount could have accessed since the feature was enabled.
- Restrict who can create Policy and ClusterPolicy resources via RBAC, especially in multi-tenant clusters.
Patch Information
The fix is available in Kyverno 1.16.2. The upstream patch introduces validation on the ServiceCall.URL field. Refer to the Kyverno GitHub Security Advisory GHSA-fmqp-4wfc-w3v7 for release notes and upgrade guidance.
Workarounds
- Apply a NetworkPolicy or CNI egress rule to the Kyverno controller namespace that blocks traffic to 169.254.169.254/32, IPv6 link-local ranges, and internal-only CIDRs.
- Disable the APICall feature or restrict its usage to ClusterPolicy objects managed only by platform administrators.
- Enforce IMDSv2 with hop-limit 1 on AWS nodes to prevent pods from reaching the instance metadata service.
- Use an admission controller or OPA/Gatekeeper rule to reject any Kyverno Policy whose apiCall.service.url is not on an approved allow-list.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
