CVE-2025-15613 Kyverno before v1.13.4 SSRF via Service Call
Attackers with policy creation permissions can exploit SSRF in Kyverno to exfiltrate sensitive cluster data, including secrets, by directing service calls to external servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-15613?
CVE-2025-15613 is a medium-severity server-side request forgery vulnerability in kyverno, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.
Weakness: CWE-918
Which versions are affected by CVE-2025-15613?
4 open source packages ship an affected version, including github.com/kyverno/kyverno and kyverno.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kyverno/kyverno Go | All versions | None |
github.com/kyverno/kyverno Go | All versions to 1.13.4 | None |
github.com/kyverno/kyverno Go | All versions to 1.13.4 | None |
kyverno Bitnami | All versions | 1.13.4 |
How do I fix CVE-2025-15613?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-15613 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15613 exists.
Sources
Also known as BIT-kyverno-2025-15613, CLEANSTART-2026-HT74198, GHSA-459x-q9hg-4gpq, GHSA-8g8h-v9pm-r6xg, GO-2025-3615, MINI-249f-gjvh-fwr5 and 17 more.