Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has no validation — it can point anywhere, including attacker-controlled servers. Since the admission controller SA has permissions to patch webhook configurations, a stolen token leads to full cluster compromise. Versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4 patch the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-25 | 1 | Disclosure1 |
| 2026-04-29 | 1 | Patch1 |
CVE-2026-41323 Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in Cl… https://www.cve.org/CVERecord?id=CVE-2026-41323
Post summary
The post briefly announces that earlier Kyverno releases are vulnerable via the apiCall feature, but provides no PoC, exploit, patch, or exploitation evidence.
🚨 Kyverno alert CVE-2026-41323 → ServiceAccount token leakage ⚠️ Patch now & rotate tokens. https://vulert.com/vuln-db/CVE-2026-41323 #CyberSecurity #Kubernetes #Vulert https://t.co/6evfI7y3wI
Post summary
The tweet alerts on CVE-2026-41323, a ServiceAccount token leakage in Kyverno, and urges users to patch immediately and rotate tokens.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kyverno | kyverno | - | - | - |
| App | kyverno | kyverno | - | - | - |