The Unpatched Kyverno SSRF Flaw That Turns Policies Into Cluster-Wide Backdoors

A critical SSRF vulnerability (CVE-2026-4789) in Kyverno's CEL HTTP functions (Get/Post) allows an attacker with namespace-level permissions to cause the Kyverno admission controller to issue arbitrary HTTP requests, potentially exposing cloud provider metadata and internal cluster services; CERT/CC could not reach the vendor and no patch is currently available, so administrators are advised to apply URL validation, restrict outbound destinations, and enforce default-deny network policies as mitigations.