CVE-2026-40868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40868", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T15:57:41.718Z", "datePublished": "2026-04-21T18:22:01.502Z", "dateUpdated": "2026-04-22T13:35:50.296Z"}, "containers": {"cna": {"title": "kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token", "problemTypes": [{"descriptions": [{"cweId": "CWE-922", "lang": "en", "description": "CWE-922: Insecure Storage of Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp"}], "affected": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"version": "< 1.16.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T18:22:01.502Z"}, "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno\u2019s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4."}], "source": {"advisory": "GHSA-q93q-v844-jrqp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:34:55.762312Z", "id": "CVE-2026-40868", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:35:50.296Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40868", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T13:34:55.762312Z"}}}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:35:15.883Z"}}], "cna": {"title": "kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token", "source": {"advisory": "GHSA-q93q-v844-jrqp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"status": "affected", "version": "< 1.16.4"}]}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp", "name": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno\u2019s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-922", "description": "CWE-922: Insecure Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T18:22:01.502Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40868", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:35:50.296Z", "dateReserved": "2026-04-15T15:57:41.718Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T18:22:01.502Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kyverno", "vendor": "kyverno", "versions": [{"status": "affected", "version": "< 1.16.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "matchCriteriaId": "380BEA9B-8371-4EA9-A225-86EBBE80F50F", "versionEndExcluding": "1.16.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno\u2019s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4."}, {"lang": "es", "value": "Kyverno es un motor de pol\u00edticas dise\u00f1ado para equipos de ingenier\u00eda de plataformas nativas de la nube. Antes de la versi\u00f3n 1.16.4, el asistente apiCall servicecall de Kyverno inyecta impl\u00edcitamente Authorization: Bearer ... utilizando el token de cuenta de servicio del controlador de Kyverno cuando una pol\u00edtica no establece expl\u00edcitamente un encabezado de autorizaci\u00f3n. Debido a que context.apiCall.service.url est\u00e1 controlado por pol\u00edticas, esto puede enviar el token de cuenta de servicio de Kyverno a un endpoint controlado por un atacante (delegado confundido). Las pol\u00edticas con espacio de nombres est\u00e1n bloqueadas para el uso de servicecall por la puerta urlPath con espacio de nombres en pkg/engine/apicall/apiCall.go, por lo que este informe se limita al uso de ClusterPolicy y contexto global. Esta vulnerabilidad se corrige en la versi\u00f3n 1.16.4."}], "id": "CVE-2026-40868", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40868", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:34:55.762312Z", "version": "2.0.3"}}]}, "published": "2026-04-21T19:16:18.420", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-922"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.16.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kyverno", "source": "cna", "vendor": "kyverno"}, "product": "kyverno", "vendor": "kyverno"}], "analysis": {"en": {"generated_at": "2026-04-22T05:34:25.589828+00:00", "value": {"mitigation_remediation": ["Upgrade to Kyverno\u202f1.16.4 or later, which removes the implicit bearer token injection. ", "Restrict the creation of ClusterPolicy objects to trusted administrators and enforce policy reviews to ensure only trusted endpoints are used. ", "Apply network controls that limit the Kyverno controller\u2019s outbound traffic to internal services only, preventing accidental exposure of the service account token to external hosts."], "summary": {"action": "Immediate Patch", "impact": "Token Leakage"}, "threat_synthesis": {"affected_systems": "The defect resides in the community edition of Kyverno, the policy engine for Kubernetes. Versions before 1.16.4 are affected. The flaw only impacts policies of type ClusterPolicy or global\u2011context, as namespaced policies are blocked by an internal URL gate.", "description_and_impact": "Kyverno\u2019s apiCall servicecall helper automatically adds an Authorization: Bearer header when a policy omits an explicit header, using the Kyverno controller\u2019s service account token. Because the endpoint URL is supplied by policy, an attacker who can create a ClusterPolicy that points to a malicious endpoint can cause Kyverno to send its privileged token over the network. This leads to uncontrolled token disclosure, allowing the attacker to impersonate Kyverno and potentially gain full cluster access. The vulnerability is a token\u2011to\u2011service leakage (CWE\u2011922).", "risk_and_exploitability": "The CVSS score of 8.1 signals high severity. No EPSS data is available and the vulnerability is not listed in CISA KEV. Exploitation requires the ability to create or modify a ClusterPolicy, a privilege usually restricted to cluster administrators. Attacks would involve crafting a malicious servicecall policy that directs Kyverno to an attacker\u2011controlled endpoint, causing the service account token to be sent outbound. The risk is significant for environments with loose RBAC or poor network segmentation."}}}}, "created": "2026-04-22T03:30:06.543018+00:00", "updated": "2026-04-22T05:45:09.821550+00:00", "vendors": ["kyverno", "kyverno$PRODUCT$kyverno"]}