CVE-2026-41323

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.18.0 Kyverno versions prior to 1.17.2 Kyverno versions prior to 1.16.4

Description The apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. Because the service URL lacks validation, it can be directed to attacker-controlled servers. Since the admission controller ServiceAccount possesses permissions to patch webhook configurations, the theft of this token can result in full cluster compromise.

Recommendations Update to version 1.18.0 or newer. Update to version 1.17.2 or newer. Update to version 1.16.4 or newer. Rotate ServiceAccount tokens.