{"id":"CVE-2025-15613","title":"Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality","summary":"Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service conf…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"kyverno","product":"github.com/kyverno/kyverno","affected":["github.com/kyverno/kyverno <= 1.13.4"],"published":"2026-09-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T15:43:03.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15613","references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.13.4-ssrf-via-service-call","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kyverno/kyverno"},{"url":"https://pkg.go.dev/vuln/GO-2025-3615"}],"tags":["nvd","osv","go"],"epss":0.00266,"epssPercentile":0.18704,"aliases":["GHSA-459x-q9hg-4gpq","GO-2025-3615","BIT-kyverno-2025-15613"],"ecosystem":"go","ingestedAt":"2026-09-02T19:31:26.444Z","slug":"CVE-2025-15613","body":"## Overview\n\nKyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-15613)\n\nAffected packages:\n\n- `github.com/kyverno/kyverno <= 1.13.4`\n\nSource: https://osv.dev/vulnerability/GHSA-459x-q9hg-4gpq","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201402,"id":"CVE-2025-15613","ts":1789399408552,"field":"cvss","old":null,"new":"6.5"},{"seq":201401,"id":"CVE-2025-15613","ts":1789399408552,"field":"severity","old":"high","new":"medium"},{"seq":200137,"id":"CVE-2025-15613","ts":1789396783031,"field":"cvss","old":"6.5","new":null},{"seq":200136,"id":"CVE-2025-15613","ts":1789396783031,"field":"severity","old":"medium","new":"high"},{"seq":196933,"id":"CVE-2025-15613","ts":1789384249950,"field":"cvss","old":null,"new":"6.5"},{"seq":196932,"id":"CVE-2025-15613","ts":1789384249950,"field":"severity","old":"high","new":"medium"},{"seq":195860,"id":"CVE-2025-15613","ts":1789383206773,"field":"cvss","old":"6.5","new":null},{"seq":195859,"id":"CVE-2025-15613","ts":1789383206773,"field":"severity","old":"medium","new":"high"},{"seq":194788,"id":"CVE-2025-15613","ts":1789380227757,"field":"cvss","old":null,"new":"6.5"},{"seq":194787,"id":"CVE-2025-15613","ts":1789380227757,"field":"severity","old":"high","new":"medium"},{"seq":193576,"id":"CVE-2025-15613","ts":1789378074684,"field":"cvss","old":"6.5","new":null},{"seq":193575,"id":"CVE-2025-15613","ts":1789378074684,"field":"severity","old":"medium","new":"high"},{"seq":192362,"id":"CVE-2025-15613","ts":1789376143677,"field":"cvss","old":null,"new":"6.5"},{"seq":192361,"id":"CVE-2025-15613","ts":1789376143677,"field":"severity","old":"high","new":"medium"},{"seq":191150,"id":"CVE-2025-15613","ts":1789372919706,"field":"cvss","old":"6.5","new":null},{"seq":191149,"id":"CVE-2025-15613","ts":1789372919706,"field":"severity","old":"medium","new":"high"},{"seq":189934,"id":"CVE-2025-15613","ts":1789369066402,"field":"cvss","old":null,"new":"6.5"},{"seq":189933,"id":"CVE-2025-15613","ts":1789369066402,"field":"severity","old":"high","new":"medium"},{"seq":188722,"id":"CVE-2025-15613","ts":1789367900229,"field":"cvss","old":"6.5","new":null},{"seq":188721,"id":"CVE-2025-15613","ts":1789367900229,"field":"severity","old":"medium","new":"high"},{"seq":187504,"id":"CVE-2025-15613","ts":1789364907718,"field":"cvss","old":null,"new":"6.5"},{"seq":187503,"id":"CVE-2025-15613","ts":1789364907718,"field":"severity","old":"high","new":"medium"},{"seq":186292,"id":"CVE-2025-15613","ts":1789362838266,"field":"cvss","old":"6.5","new":null},{"seq":186291,"id":"CVE-2025-15613","ts":1789362838266,"field":"severity","old":"medium","new":"high"},{"seq":185077,"id":"CVE-2025-15613","ts":1789360895936,"field":"cvss","old":null,"new":"6.5"},{"seq":185076,"id":"CVE-2025-15613","ts":1789360895936,"field":"severity","old":"high","new":"medium"},{"seq":183865,"id":"CVE-2025-15613","ts":1789357755305,"field":"cvss","old":"6.5","new":null},{"seq":183864,"id":"CVE-2025-15613","ts":1789357755305,"field":"severity","old":"medium","new":"high"},{"seq":182117,"id":"CVE-2025-15613","ts":1789354030634,"field":"cvss","old":null,"new":"6.5"},{"seq":182116,"id":"CVE-2025-15613","ts":1789354030634,"field":"severity","old":"high","new":"medium"},{"seq":180910,"id":"CVE-2025-15613","ts":1789352788150,"field":"cvss","old":"6.5","new":null},{"seq":180909,"id":"CVE-2025-15613","ts":1789352788150,"field":"severity","old":"medium","new":"high"},{"seq":179703,"id":"CVE-2025-15613","ts":1789349903442,"field":"cvss","old":null,"new":"6.5"},{"seq":179702,"id":"CVE-2025-15613","ts":1789349903442,"field":"severity","old":"high","new":"medium"},{"seq":178496,"id":"CVE-2025-15613","ts":1789347617197,"field":"cvss","old":"6.5","new":null},{"seq":178495,"id":"CVE-2025-15613","ts":1789347617197,"field":"severity","old":"medium","new":"high"},{"seq":177289,"id":"CVE-2025-15613","ts":1789346093554,"field":"cvss","old":null,"new":"6.5"},{"seq":177288,"id":"CVE-2025-15613","ts":1789346093554,"field":"severity","old":"high","new":"medium"},{"seq":176082,"id":"CVE-2025-15613","ts":1789342579478,"field":"cvss","old":"6.5","new":null},{"seq":176081,"id":"CVE-2025-15613","ts":1789342579478,"field":"severity","old":"medium","new":"high"},{"seq":175868,"id":"CVE-2025-15613","ts":1789342192426,"field":"cvss","old":null,"new":"6.5"},{"seq":175867,"id":"CVE-2025-15613","ts":1789342192426,"field":"severity","old":"high","new":"medium"},{"seq":175406,"id":"CVE-2025-15613","ts":1789338204231,"field":"cvss","old":"6.5","new":null},{"seq":175405,"id":"CVE-2025-15613","ts":1789338204231,"field":"severity","old":"medium","new":"high"},{"seq":174201,"id":"CVE-2025-15613","ts":1789334532058,"field":"cvss","old":null,"new":"6.5"},{"seq":174200,"id":"CVE-2025-15613","ts":1789334532058,"field":"severity","old":"high","new":"medium"},{"seq":170624,"id":"CVE-2025-15613","ts":1789328197364,"field":"cvss","old":"6.5","new":null},{"seq":170623,"id":"CVE-2025-15613","ts":1789328197364,"field":"severity","old":"medium","new":"high"},{"seq":169419,"id":"CVE-2025-15613","ts":1789326813827,"field":"cvss","old":null,"new":"6.5"},{"seq":169418,"id":"CVE-2025-15613","ts":1789326813827,"field":"severity","old":"high","new":"medium"}]}