https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T15:45:16.518485+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bit-kyverno-2025-15613 BIT-kyverno-2025-15613 — Kyverno before v1.13.4 SSRF via Service Call 2026-10-01T15:45:16.549457+00:00

Affected: Bitnami: kyverno

Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.

 https://vulnerability.circl.lu/vuln/fkie_cve-2025-15613 fkie_cve-2025-15613 2026-10-01T15:45:16.549550+00:00

Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.

 https://vulnerability.circl.lu/vuln/ghsa-8g8h-v9pm-r6xg GHSA-8g8h-v9pm-r6xg 2026-10-01T15:45:16.549630+00:00

Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.