Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck

CVE-2026-84195Kyverno before 1.16.4 Credential Leak via apiCall

High 7.7

In plain English

A high-severity information exposure in kyverno from kyverno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kyverno/kyverno	1.17.0	GHSA-8wfp-579w-6r25
Go	github.com/kyverno/kyverno	1.17.0	GO-2026-5268

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	0 – before 1.16.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-8wfp-579w-6r25) vendor-advisory
VulnCheck Advisory: Kyverno before 1.16.4 Credential Leak via apiCall third-party-advisory