CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests made in apiCall service mode, even when no explicit authorization headers are configured. An attacker with low privileges (e.g., the ability to influence or craft a Kyverno policy whose apiCall targets an external or attacker-controlled endpoint) can receive the token in the outbound request and capture it. With the admission controller's ServiceAccount token, the attacker gains the controller's authority, allowing full control over Kyverno policies and access to cluster resources. Any Kyverno deployment running a version before 1.16.4 that uses apiCall service mode toward non-trusted endpoints is affected; deployments that do not use apiCall calls to external endpoints are not exposed. No public proof-of-concept, KEV listing, or confirmed exploitation is known; EPSS puts 30-day exploitation probability at about 0.3%.

What to do: Upgrade to Kyverno 1.16.4 or later. Until patched, audit Kyverno policies for apiCall (context) usage and ensure calls target only trusted in-cluster endpoints, and restrict the Kyverno admission controller's outbound network access where feasible. If exfiltration is suspected, rotate the admission controller's ServiceAccount token and review Kubernetes API audit logs for unexpected use of that identity.