CVE-2025-15613

Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq
https://www.vulncheck.com/advisories/kyverno-before-1.13.4-ssrf-via-service-call

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Kyverno en versiones anteriores a la 1.13.4 es vulnerable a falsificación de petición del lado del servidor (SSRF) a través de su funcionalidad Llamada de Servicio. Un atacante con permiso para crear Políticas (de clúster) de Kyverno puede especificar una URL externa en la configuración apiCall/service de una política; aunque la Llamada de Servicio está documentada para servicios dentro del clúster, también resuelve direcciones externas, permitiendo solicitudes a un servidor controlado por el atacante. Dado que los datos de contexto de la política (incluidos los contenidos de recursos de Kubernetes como secretos) se envían en estas solicitudes, un atacante puede exfiltrar datos sensibles del clúster.

Information

Published : 2026-09-01 12:17

Updated : 2026-10-19 22:10

NVD link : CVE-2025-15613

Mitre link : CVE-2025-15613

CVE.ORG link : CVE-2025-15613

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-15613", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15613", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T12:14:32.209128Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"status": "affected", "version": "0", "lessThan": "1.13.4", "versionType": "semver"}, {"status": "unaffected", "version": "1.13.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/kyverno/kyverno", "defaultStatus": "unaffected"}]}], "published": "2026-09-01T12:17:18.183", "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/kyverno-before-1.13.4-ssrf-via-service-call", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data."}, {"lang": "es", "value": "Kyverno en versiones anteriores a la 1.13.4 es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de su funcionalidad Llamada de Servicio. Un atacante con permiso para crear Pol\u00edticas (de cl\u00faster) de Kyverno puede especificar una URL externa en la configuraci\u00f3n apiCall/service de una pol\u00edtica; aunque la Llamada de Servicio est\u00e1 documentada para servicios dentro del cl\u00faster, tambi\u00e9n resuelve direcciones externas, permitiendo solicitudes a un servidor controlado por el atacante. Dado que los datos de contexto de la pol\u00edtica (incluidos los contenidos de recursos de Kubernetes como secretos) se env\u00edan en estas solicitudes, un atacante puede exfiltrar datos sensibles del cl\u00faster."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "disclosure@vulncheck.com"}