Kyverno versions prior to 1.19.1 contain a server-side request forgery (SSRF) vulnerability. This issue arises because certain legacy API call paths do not enforce egress filtering or validate service URLs, allowing crafted policies or resource submitters to make Kyverno send HTTP requests to arbitrary internal or external hosts. The vulnerability can lead to unauthorized access to cloud metadata endpoints and internal services using Kyverno's network privileges. The flaw is fixed in version 1.19.1.