---
id: CVE-2026-84199
title: >-
  Kyverno before 1.16.2 contains a server-side request forgery (SSRF)
  vulnerability in the APICall feature
summary: >-
  Kyverno before 1.16.2 contains a server-side request forgery (SSRF)
  vulnerability in the APICall feature. The URL field in a Policy's ServiceCall
  configuration is not validated, so a user with namespace-level Policy creation
  permissions …
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: kyverno
product: github.com/kyverno/kyverno
affected:
  - github.com/kyverno/kyverno < 1.16.2
patched:
  - github.com/kyverno/kyverno 1.16.2
published: '2026-09-01'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:43:03.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84199'
references:
  - url: 'https://github.com/kyverno/kyverno/security/advisories/GHSA-fmqp-4wfc-w3v7'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/kyverno-before-1.16.2-ssrf-via-apicall-feature
    label: disclosure@vulncheck.com
  - url: 'https://github.com/kyverno/kyverno/security/advisories/GHSA-fmqp-4wfc-w3v7'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/kyverno/kyverno'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84199.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84199'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84199'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84199'
tags:
  - nvd
  - osv
  - go
  - csaf
  - vex
  - red-hat
epss: 0.0026
epssPercentile: 0.18047
aliases:
  - GHSA-fmqp-4wfc-w3v7
  - GO-2026-5371
ecosystem: go
ingestedAt: '2026-09-02T19:31:26.788Z'
---

## Overview

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants' resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants' secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84199)

Affected packages:

- `github.com/kyverno/kyverno < 1.16.2`

Patched in:

- `github.com/kyverno/kyverno 1.16.2`

Source: https://osv.dev/vulnerability/GHSA-fmqp-4wfc-w3v7

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-11 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84199.json)