CVE-2026-41323

HighPublic PoC

Published: 24 April 2026

Published

24 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0003 7.3th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41323 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Kyverno Kyverno. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of service URLs in Kyverno's apiCall feature to block SSRF attacks directing requests to attacker-controlled servers.

AC-6 Least Privilege good match

prevent

Enforces least privilege on the Kyverno admission controller ServiceAccount to prevent full cluster compromise from stolen tokens.

AC-4 Information Flow Enforcement partial match

prevent

Mediates and enforces information flows from Kyverno to only approved destinations, limiting arbitrary outbound requests with attached tokens.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1528 Steal Application Access Token Credential Access

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

attack.mitre.org →

Why these techniques?

The SSRF vulnerability in Kyverno's apiCall feature directly enables exploitation of the application to direct requests with the ServiceAccount token to attacker servers (T1190) and facilitates theft of the application access token (T1528) for cluster compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has no…

validation — it can point anywhere, including attacker-controlled servers. Since the admission controller SA has permissions to patch webhook configurations, a stolen token leads to full cluster compromise. Versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4 patch the issue.

Deeper analysisAI

CVE-2026-41323 is a high-severity vulnerability (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) affecting Kyverno, a policy engine for cloud native platform engineering teams, specifically its apiCall feature in ClusterPolicy. In versions prior to 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, the feature automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests without validating the service URL, allowing requests to be directed to arbitrary endpoints, including attacker-controlled servers. This issue is linked to CWE-200 (Exposure of Sensitive Information) and CWE-918 (Server-Side Request Forgery).

The vulnerability can be exploited by an attacker with low privileges (PR:L) who can create or modify a ClusterPolicy containing an apiCall rule pointing to a malicious service URL. When Kyverno processes the policy during admission review, it sends the request with the admission controller's ServiceAccount token, enabling token theft. The admission controller ServiceAccount typically has permissions to patch webhook configurations, allowing a token thief to achieve full Kubernetes cluster compromise by escalating privileges and modifying critical cluster resources.

Kyverno's security advisory (GHSA-f9g8-6ppc-pqq4) and related patch commits confirm the issue is fixed in versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4. Security practitioners should upgrade to these versions or later, audit existing ClusterPolicies for apiCall rules with untrusted URLs, and review ServiceAccount permissions for Kyverno's admission controller to follow least-privilege principles.