CVE-2026-40868
Fixed in a distro release EPSS <1%CVSS 8.1
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4.
Products: kyverno
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kyverno/kyverno | 1.17.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-kyverno-1.13 | no fix |
| Chainguard | commercial-kyverno-1.14 | no fix |
| Chainguard | commercial-kyverno-1.15 | no fix |
| Chainguard | commercial-kyverno-1.16 | no fix |
| Chainguard | commercial-kyverno-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-background-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyverno-reports-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.17 | 1.17.2-r0 |
| Chainguard | commercial-kyvernopre-1.13 | no fix |
| Chainguard | commercial-kyvernopre-1.14 | no fix |
| Chainguard | commercial-kyvernopre-1.15 | no fix |
| Chainguard | commercial-kyvernopre-1.16 | no fix |
| Chainguard | commercial-kyvernopre-1.17 | 1.17.2-r0 |
| Chainguard | kyverno-1.13 | no fix |
| Chainguard | kyverno-1.14 | no fix |
| Chainguard | kyverno-1.15 | no fix |
| Chainguard | kyverno-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-1.16 | 1.16.4-r7 |
| Chainguard | kyverno-background-controller-1.13 | no fix |
| Chainguard | kyverno-background-controller-1.14 | no fix |
| Chainguard | kyverno-background-controller-1.15 | no fix |
| Chainguard | kyverno-background-controller-1.16 | no fix |
| Chainguard | kyverno-background-controller-fips-1.13 | no fix |
| Chainguard | kyverno-background-controller-fips-1.14 | no fix |
| Chainguard | kyverno-background-controller-fips-1.15 | no fix |
| Chainguard | kyverno-background-controller-fips-1.16 | no fix |
| Chainguard | kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | no fix |
| Chainguard | kyverno-cli-1.13 | no fix |
| Chainguard | kyverno-cli-1.14 | no fix |
| Chainguard | kyverno-cli-1.15 | no fix |
| Chainguard | kyverno-cli-1.16 | no fix |
| Chainguard | kyverno-cli-fips-1.13 | no fix |
| Chainguard | kyverno-cli-fips-1.14 | no fix |
| Chainguard | kyverno-cli-fips-1.15 | no fix |
| Chainguard | kyverno-cli-fips-1.16 | no fix |
| Chainguard | kyverno-fips-1.13 | no fix |
| Chainguard | kyverno-fips-1.14 | no fix |
| Chainguard | kyverno-fips-1.15 | no fix |
| Chainguard | kyverno-fips-1.16 | no fix |
| Chainguard | kyverno-init-container-1.13 | no fix |
| Chainguard | kyverno-init-container-1.14 | no fix |
| Chainguard | kyverno-init-container-1.15 | no fix |
| Chainguard | kyverno-init-container-1.16 | no fix |
| Chainguard | kyverno-init-container-fips-1.13 | no fix |
| Chainguard | kyverno-init-container-fips-1.14 | no fix |
| Chainguard | kyverno-init-container-fips-1.15 | no fix |
| Chainguard | kyverno-init-container-fips-1.16 | no fix |
| Chainguard | kyverno-notation-aws | 1.1-r49 |
| Chainguard | kyverno-notation-aws-fips | 1.1-r46 |
| Chainguard | kyverno-reports-controller-1.13 | no fix |
| Chainguard | kyverno-reports-controller-1.14 | no fix |
| Chainguard | kyverno-reports-controller-1.15 | no fix |
| Chainguard | kyverno-reports-controller-1.16 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.13 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.14 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.15 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.16 | no fix |
| Chainguard | reports-server | no fix |
| Wolfi | kyverno-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-1.16 | 1.16.4-r7 |
| Wolfi | kyverno-background-controller-1.16 | no fix |
| Wolfi | kyverno-cleanup-controller-1.16 | no fix |
| Wolfi | kyverno-cli-1.16 | no fix |
| Wolfi | kyverno-init-container-1.16 | no fix |
| Wolfi | kyverno-notation-aws | 1.1-r49 |
| Wolfi | kyverno-reports-controller-1.16 | no fix |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |