Vulnerability Description
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-8wfp-579w-6r25
- https://www.vulncheck.com/advisories/kyverno-before-1.16.4-credential-leak-via-a
- https://github.com/kyverno/kyverno/security/advisories/GHSA-8wfp-579w-6r25
FAQ
What is CVE-2026-84195?
CVE-2026-84195 is a vulnerability with a CVSS score of 7.7 (HIGH). Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exf...
How severe is CVE-2026-84195?
CVE-2026-84195 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84195?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.