GHSA-qqrv-2hch-83q4
Duplicate Advisory: Kyverno is vulnerable to server-side request forgery (SSRF)
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
- None yet
- No fixed version published
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rggm-jjmc-3394. This link is maintained to preserve external references.
Original Description
Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/kyverno/kyverno | >= 1.16.0, <= 1.17.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- Low
- Integrity (subsequent systems)
- Low
- Availability (subsequent systems)
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-79gf-7frw-68m9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system | Critical | Also affects github.com/kyverno/kyverno |
| GHSA-fpjq-c37h-cqcv Kyverno Controller Denial of Service via forEach Mutation Panic | High | Also affects github.com/kyverno/kyverno |
| GHSA-8wfp-579w-6r25 Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) | High | Also affects github.com/kyverno/kyverno |
| GHSA-f9g8-6ppc-pqq4 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL | Critical | Also affects github.com/kyverno/kyverno |
| GHSA-cvq5-hhx3-f99p Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) | High | Also affects github.com/kyverno/kyverno |
| GHSA-q93q-v844-jrqp kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token | High | Also affects github.com/kyverno/kyverno |
| GHSA-fmqp-4wfc-w3v7 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach | Medium | Also affects github.com/kyverno/kyverno |
| GHSA-qr4g-8hrp-c4rw Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF | High | Also affects github.com/kyverno/kyverno |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor