Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary… (CVE-2026-84196)

The vulnerability in Kyverno before version 1.18.0 is a server-side request forgery (CWE-918) in the apiCall.service.url functionality. Authenticated users can manipulate variable substitution to send arbitrary HTTP requests to internal or protected endpoints, including cloud metadata services and loopback addresses. The responses from these requests are reflected in admission error messages, allowing attackers to exfiltrate data without blind guessing. This vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official patch or remediation details are provided in the input data.

An attacker with authentication privileges can exploit this SSRF vulnerability to send arbitrary HTTP requests to internal or protected network resources. This can lead to unauthorized information disclosure by reflecting response data in error messages. The impact is limited to confidentiality loss; integrity and availability are not affected according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the apiCall.service.url functionality to trusted users only and monitor for suspicious use of variable substitution in requests. Avoid exposing sensitive internal endpoints that could be targeted by SSRF.