Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. (CVE-2025-15613)

Kyverno before v1.13.4 is vulnerable to SSRF via its Service Call feature. An attacker authorized to create Kyverno (Cluster)Policies can configure the apiCall/service to resolve external addresses, not just in-cluster services. This causes Kyverno to send policy context data, including sensitive Kubernetes resource information, to external attacker-controlled servers, enabling data exfiltration. The vulnerability is tracked as CVE-2025-15613 with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No known exploits in the wild have been reported. No patch or remediation information is provided in the source data.

An attacker with permission to create Kyverno policies can exploit this SSRF vulnerability to cause Kyverno to send sensitive cluster data, including Kubernetes secrets, to external servers controlled by the attacker. This results in confidentiality loss of sensitive information. The vulnerability does not impact integrity or availability directly. The attack requires some privilege (policy creation) and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to create Kyverno (Cluster)Policies to trusted users only to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.