Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit …

Kyverno versions before 1.16.4 contain a critical vulnerability where the admission controller automatically attaches its ServiceAccount token to outbound HTTP requests when operating in apiCall service mode. This occurs without requiring explicit authorization headers, creating a significant security risk. Attackers can exploit this by directing apiCall requests to external or attacker-controlled endpoints to capture the token. Once obtained, the exfiltrated token grants full control over Kyverno policies and cluster resources. The vulnerability affects Kubernetes clusters using Kyverno as a policy engine. The fix is available in Kyverno version 1.16.4 and later. Users are advised to upgrade immediately to mitigate the risk of credential theft and cluster compromise.