Summary
A Server-Side Request Forgery (SSRF) vulnerability in Kyverno's apiCall.service.url feature allows authenticated users to cause the admission controller to send arbitrary HTTP requests to attacker-controlled or internal endpoints. When a ClusterPolicy uses variable substitution in the service URL (for example, http://{{ request.object.metadata.annotations.target }}), user-controlled input can influence the request destination. The vulnerability is non-blind: response data from internal services is reflected back to the user through admission webhook error messages, enabling data exfiltration directly via kubectl output. The HTTP execution path lacks URL validation, IP range filtering, and redirect-chain restrictions.
Impact
Authenticated cluster users can direct Kyverno to issue requests to loopback addresses, link-local ranges such as cloud instance metadata endpoints, internal ClusterIP services, and arbitrary external hosts by supplying crafted resource fields or annotations that influence a URL template. Because non-2xx response bodies and JSON parse failures are propagated back in admission error messages, the SSRF is non-blind: retrieved content is directly readable from kubectl apply output. The advisory notes multi-tenant boundary violation as an impact, as Kyverno's privileged ServiceAccount executes these requests regardless of the requesting user's actual permissions.
Detection
Inspect all ClusterPolicy and Policy resources for apiCall.service.url fields containing variable substitution patterns such as {{ request.object.* }}. Review Kubernetes API server audit logs for admission webhook responses that include unexpected error bodies containing IP addresses or internal service content. Monitor for policy-driven HTTP requests to link-local ranges (169.254.0.0/16), loopback (127.0.0.1), or internal cluster service addresses.
Mitigation
Upgrade Kyverno to version 1.18.0 or later, which addresses the missing URL validation and filtering in the apiCall HTTP execution path. Until the upgrade is complete, audit all policies that use apiCall.service.url with variable substitution and either remove them or replace the variable-derived URL segments with hardcoded trusted values. Apply network egress policies on the Kyverno controller pods to restrict outbound connections to approved endpoints, reducing the exploitable surface for SSRF.