CVE-2026-41323
Fixed in a distro release EPSS <1%CVSS 8.1
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has no validation — it can point anywhere, including attacker-controlled servers. Since the admission controller SA has permissions to patch webhook configurations, a stolen token leads to full cluster compromise. Versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4 patch the issue.
Products: kyverno
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kyverno/kyverno | 1.17.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-kyverno-1.13 | no fix |
| Chainguard | commercial-kyverno-1.14 | no fix |
| Chainguard | commercial-kyverno-1.15 | no fix |
| Chainguard | commercial-kyverno-1.16 | no fix |
| Chainguard | commercial-kyverno-1.17 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-background-controller-1.17 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-cleanup-controller-1.17 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.13 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.14 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.15 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.16 | no fix |
| Chainguard | commercial-kyverno-reports-controller-1.17 | no fix |
| Chainguard | commercial-kyvernopre-1.13 | no fix |
| Chainguard | commercial-kyvernopre-1.14 | no fix |
| Chainguard | commercial-kyvernopre-1.15 | no fix |
| Chainguard | commercial-kyvernopre-1.16 | no fix |
| Chainguard | commercial-kyvernopre-1.17 | no fix |
| Chainguard | kyverno-1.13 | no fix |
| Chainguard | kyverno-1.14 | no fix |
| Chainguard | kyverno-1.15 | no fix |
| Chainguard | kyverno-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-background-controller-1.13 | no fix |
| Chainguard | kyverno-background-controller-1.14 | no fix |
| Chainguard | kyverno-background-controller-1.15 | no fix |
| Chainguard | kyverno-background-controller-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-background-controller-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-background-controller-fips-1.13 | no fix |
| Chainguard | kyverno-background-controller-fips-1.14 | no fix |
| Chainguard | kyverno-background-controller-fips-1.15 | no fix |
| Chainguard | kyverno-background-controller-fips-1.16 | no fix |
| Chainguard | kyverno-background-controller-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cleanup-controller-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-cleanup-controller-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cleanup-controller-fips-1.13 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.14 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.15 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | no fix |
| Chainguard | kyverno-cleanup-controller-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cli-1.13 | no fix |
| Chainguard | kyverno-cli-1.14 | no fix |
| Chainguard | kyverno-cli-1.15 | no fix |
| Chainguard | kyverno-cli-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-cli-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-cli-fips-1.13 | no fix |
| Chainguard | kyverno-cli-fips-1.14 | no fix |
| Chainguard | kyverno-cli-fips-1.15 | no fix |
| Chainguard | kyverno-cli-fips-1.16 | no fix |
| Chainguard | kyverno-cli-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-fips-1.13 | no fix |
| Chainguard | kyverno-fips-1.14 | no fix |
| Chainguard | kyverno-fips-1.15 | no fix |
| Chainguard | kyverno-fips-1.16 | no fix |
| Chainguard | kyverno-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-init-container-1.13 | no fix |
| Chainguard | kyverno-init-container-1.14 | no fix |
| Chainguard | kyverno-init-container-1.15 | no fix |
| Chainguard | kyverno-init-container-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-init-container-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-init-container-fips-1.13 | no fix |
| Chainguard | kyverno-init-container-fips-1.14 | no fix |
| Chainguard | kyverno-init-container-fips-1.15 | no fix |
| Chainguard | kyverno-init-container-fips-1.16 | no fix |
| Chainguard | kyverno-init-container-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-notation-aws | 1.1-r49 |
| Chainguard | kyverno-notation-aws-fips | 1.1-r46 |
| Chainguard | kyverno-readiness-checker-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-readiness-checker-fips-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-reports-controller-1.13 | no fix |
| Chainguard | kyverno-reports-controller-1.14 | no fix |
| Chainguard | kyverno-reports-controller-1.15 | no fix |
| Chainguard | kyverno-reports-controller-1.16 | 1.16.4-r1 |
| Chainguard | kyverno-reports-controller-1.17 | 1.17.2-r1 |
| Chainguard | kyverno-reports-controller-fips-1.13 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.14 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.15 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.16 | no fix |
| Chainguard | kyverno-reports-controller-fips-1.17 | 1.17.2-r1 |
| Chainguard | reports-server | no fix |
| Wolfi | kyverno-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-background-controller-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-background-controller-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-cleanup-controller-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-cleanup-controller-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-cli-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-cli-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-init-container-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-init-container-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-notation-aws | 1.1-r49 |
| Wolfi | kyverno-readiness-checker-1.17 | 1.17.2-r1 |
| Wolfi | kyverno-reports-controller-1.16 | 1.16.4-r1 |
| Wolfi | kyverno-reports-controller-1.17 | 1.17.2-r1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |