Kyverno before version 1.19.1 is vulnerable to SSRF due to incomplete application of egress blocklists and scoped-token controls. While the new CEL http.Get/Post library enforces these protections, legacy apiCall service executors and GlobalContextEntry external-API paths use a plain net/http client without egress filtering or URL validation. This allows a ClusterPolicy or GlobalContextEntry author, or a lower-privileged resource submitter templating service URLs, to cause Kyverno to issue GET/POST requests to arbitrary hosts, including cloud metadata endpoints and internal cluster services. Additionally, Kyverno attaches its projected ServiceAccount token to these requests, although the token is audience-scoped, limiting replay value. The vulnerability is addressed in Kyverno 1.19.1.

An attacker with the ability to create or modify ClusterPolicies, GlobalContextEntries, or resource templates can exploit this vulnerability to make Kyverno send HTTP requests to arbitrary internal or external endpoints. This can lead to unauthorized disclosure of sensitive information such as cloud instance credentials from metadata services and access to internal services within the cluster. The attached ServiceAccount token may be used in some contexts, though its scoped nature limits the potential impact. The vulnerability has a CVSS v3.1 score of 7.6 (high severity), indicating significant confidentiality impact with limited integrity impact and no availability impact.

This vulnerability is fixed in Kyverno version 1.19.1. Users should upgrade to version 1.19.1 or later to ensure the egress blocklist and scoped-token controls are properly applied to all API call paths. No additional mitigation is required once the update is applied.