Summary​

Kyverno's apiCall service-call helper implicitly injects Authorization: Bearer <token> using the Kyverno controller's ServiceAccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the Kyverno SA token to an attacker-controlled endpoint — a confused-deputy attack.

Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this issue is scoped to ClusterPolicy and global-context usage.

Impact​

An attacker who can create or update a ClusterPolicy (or create a GlobalContextEntry) using context.apiCall.service.url can choose the request URL and observe the headers — including the implicitly injected Bearer token. The realistic threat model is a compromised GitOps pipeline: if the policy repo or controller is compromised, the resulting ClusterPolicy is untrusted input to Kyverno.

The token belongs to the Kyverno admission controller's SA, which on the default Helm install holds rights to read and patch admission webhook configurations. A leaked token therefore grants enough privilege to bypass or subvert the entire admission layer, not just the policy engine.

Detection​

Audit ClusterPolicy and GlobalContextEntry resources for apiCall.service.url values that point outside the cluster (no .svc suffix, public IPs, or names not resolved by in-cluster DNS). Treat any external host as a potential exfiltration sink. Pair this with audit-log review of patches against MutatingWebhookConfiguration / ValidatingWebhookConfiguration from the Kyverno admission controller's SA.

Mitigation​

Upgrade Kyverno to v1.16.4 or later.

Workarounds until patched:

• Restrict who can create or update ClusterPolicy and GlobalContextEntry resources via tight RBAC.
• Audit all existing policies for apiCall.service.url values pointing outside the cluster and remove or relocate them.
• After upgrade, rotate the Kyverno SA token if you have any reason to believe a malicious policy was applied during the affected window.

References​

• GHSA-q93q-v844-jrqp — Kyverno security advisory
• NVD CVE-2026-40868
• Related: CVE-2026-41323
• Service Account Token Abuse attack vector