kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

敏感信息的不安全存储

Kyverno 安全漏洞

Kyverno是Kyverno开源的一个为 Kubernetes 设计的策略引擎。 Kyverno 1.16.4之前版本存在安全漏洞，该漏洞源于apiCall servicecall助手隐式注入授权令牌，可能导致将服务账户令牌发送到攻击者控制的端点。

N/A

N/A