CVE-2025-15613

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.13.4

Description Server-side request forgery (SSRF) exists within the Service Call functionality. An attacker with permissions to create Kyverno (Cluster)Policies can specify an external URL in the apiCall/service configuration. While the Service Call is intended for in-cluster services, it also resolves external addresses, enabling requests to be sent to an attacker-controlled server. This allows for the exfiltration of sensitive cluster data, including the contents of Kubernetes resources such as secrets, which are included in the policy context data sent during these requests.

Recommendations Update to version 1.13.4 or later.