Summary​

A Server-Side Request Forgery (SSRF) vulnerability in Kyverno's CEL HTTP library (pkg/cel/libs/http/) allows users with namespace-scoped NamespacedValidatingPolicy creation permissions to make arbitrary outbound HTTP requests from the Kyverno admission controller. The http.Get() and http.Post() functions available in CEL-based policies.kyverno.io policies apply no URL validation — unlike resource.Lib, which enforces namespace boundaries for namespaced policies. This is a distinct code path from previously reported apiCall SSRF issues.

Impact​

A user with permission to create a NamespacedValidatingPolicy in their own namespace can author a CEL expression calling http.Get(<url>) targeting internal services in other namespaces, the cloud instance metadata service at 169.254.169.254, or any other reachable endpoint. Response bodies are surfaced through policy validation error messages, enabling data exfiltration across namespace and trust boundaries without any cluster-admin privilege.

Detection​

Audit NamespacedValidatingPolicy and other policies.kyverno.io resources for CEL expressions that invoke http.Get(...) or http.Post(...). Any URL resolving to 169.254.169.254, metadata.google.internal, fd00:ec2::254, or an in-cluster service in a different namespace should be treated as a strong indicator of exploitation. Review egress logs from the Kyverno admission controller pod for outbound HTTP traffic to unexpected destinations during the affected window.

Mitigation​

Upgrade Kyverno to v1.17.0 or later. Until patched:

• Restrict who can create or update NamespacedValidatingPolicy and related policies.kyverno.io resources via RBAC.
• Apply a NetworkPolicy in the Kyverno namespace that blocks egress to link-local addresses (169.254.0.0/16) and the cloud metadata service.
• If CEL http.Get/http.Post is not used in your policies, consider disabling the policies.kyverno.io CRD set on affected versions.

Related Security Guidance​

• Cloud Metadata Service Abuse — how SSRF from pods is exploited to steal IAM credentials
• Misconfigured Admission Controllers — attack vectors via admission controller abuse
• Kyverno — hardening Kyverno deployments

References​

• GHSA-rggm-jjmc-3394 — Kyverno security advisory
• NVD CVE-2026-4789