CVE-2026-40868 Details
Description
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4.
A vulnerability in Kyverno versions prior to 1.16.4 allows for the unintentional leakage of the Kyverno controller's service account token. This occurs through the 'apiCall' servicecall helper, which automatically adds an Authorization header with the service account token when none is specified. Since the request URL is controlled by the policy, this can result in the token being sent to an attacker-controlled endpoint, creating a 'confused deputy' scenario. This issue is limited to ClusterPolicy and global context usage, as namespaced policies are prevented from using servicecalls.
Users can update to Kyverno version 1.16.4 or later, set an explicit Authorization header in servicecall policies, or avoid using servicecall to arbitrary URLs in policies.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-922 | Insecure Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kyverno kyverno | < 1.16.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |