Product
Kyverno Vulnerability Allows Cross-Site Scripting
2 rules 1 TTPA remote, authenticated attacker can exploit a vulnerability in Kyverno to perform a cross-site scripting attack.
Kyverno Controller Denial of Service via forEach Mutation Panic
2 rules 2 TTPsAn unchecked type assertion in Kyverno versions v1.13.0 to v1.17.1 allows a user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff, leading to a denial of service, by crafting a malicious policy that triggers a nil pointer dereference in the forEach mutation handler.
Kyverno apiCall SSRF Leads to Cluster Takeover
2 rules 7 TTPs 3 IOCsA Server Side Request Forgery (SSRF) vulnerability in Kyverno's apiCall feature allows an attacker to exfiltrate the admission controller's ServiceAccount token by creating a ClusterPolicy with a malicious service URL, which can then be used to hijack webhooks, intercept and modify API requests, and potentially access cloud IAM credentials on cloud-hosted clusters, leading to full cluster compromise.