CVE-2026-84196

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84196", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-01T10:51:59.729Z", "datePublished": "2026-09-01T11:33:59.097Z", "dateUpdated": "2026-09-01T14:56:10.945Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-01T11:33:59.097Z"}, "datePublic": "2026-04-13T00:00:00.000Z", "title": "Kyverno before 1.18.0 Server-Side Request Forgery via apiCall", "descriptions": [{"lang": "en", "value": "Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "affected": [{"vendor": "kyverno", "product": "kyverno", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/kyverno/kyverno", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.18.0"}, {"version": "1.18.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-qr4g-8hrp-c4rw)"}, {"name": "VulnCheck Advisory: Kyverno before 1.18.0 Server-Side Request Forgery via apiCall", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall"}], "credits": [{"lang": "en", "value": "scumfrog", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T14:15:14.562726Z", "id": "CVE-2026-84196", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:56:10.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-84196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T14:15:14.562726Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:14:42.087Z"}}], "cna": {"title": "Kyverno before 1.18.0 Server-Side Request Forgery via apiCall", "credits": [{"lang": "en", "type": "reporter", "value": "scumfrog"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.18.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/kyverno/kyverno", "defaultStatus": "unaffected"}], "datePublic": "2026-04-13T00:00:00.000Z", "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw", "name": "GitHub Security Advisory (GHSA-qr4g-8hrp-c4rw)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall", "name": "VulnCheck Advisory: Kyverno before 1.18.0 Server-Side Request Forgery via apiCall", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.18.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-01T11:33:59.097Z"}}}, "cveMetadata": {"cveId": "CVE-2026-84196", "state": "PUBLISHED", "dateUpdated": "2026-09-01T14:56:10.945Z", "dateReserved": "2026-09-01T10:51:59.729Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-01T11:33:59.097Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/kyverno/kyverno", "product": "kyverno", "vendor": "kyverno", "versions": [{"lessThan": "1.18.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.18.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration."}], "id": "CVE-2026-84196", "lastModified": "2026-09-10T15:43:03.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84196", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T14:15:14.562726Z", "version": "2.0.3"}}]}, "published": "2026-09-01T12:17:49.270", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/kyverno/kyverno: Kyverno: Server-Side Request Forgery via apiCall.service.url allows information disclosure.", "id": "2526851", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526851"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Kyverno. This server-side request forgery (SSRF) vulnerability in apiCall.service.url allows authenticated users to send arbitrary HTTP requests. By injecting user-controlled input through variable substitution, attackers can target internal services, cloud metadata endpoints, and loopback addresses. The response data is reflected in admission error messages, enabling non-blind data exfiltration, which means sensitive information can be disclosed."], "mitigation": {"lang": "en:us", "value": "Ensure that no policy interpolates request-controlled data into apiCall.service.url. Audit all Policy, ClusterPolicy, and GlobalContextEntry resources for {{ }} expressions in that field and replace them with static URLs. Where a dynamic value is genuinely required, move it into the request body or a header rather than the URL, or constrain it to a fixed allowlist of permitted values before substitution. Enforce this going forward with a ValidatingAdmissionPolicy that rejects policies containing variable substitution in apiCall.service.url."}, "name": "CVE-2026-84196", "public_date": "2026-09-01T11:33:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84196\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84196\nhttps://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw\nhttps://www.vulncheck.com/advisories/kyverno-before-1.18.0-server-side-request-forgery-via-apicall"], "statement": "This vulnerability is rated Important because authenticated users can exploit a Server-Side Request Forgery (SSRF) in Kyverno's apiCall.service.url via variable substitution. This allows attackers to make arbitrary HTTP requests to internal services, cloud metadata endpoints, and loopback addresses, leading to information disclosure through admission error messages.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.18.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.18.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kyverno", "source": "cna", "vendor": "kyverno"}, "product": "kyverno", "vendor": "kyverno"}], "created": "2026-09-01T12:30:04.603239+00:00", "updated": "2026-09-01T15:00:10.729802+00:00", "vendors": ["kyverno", "kyverno$PRODUCT$kyverno"]}