CVE-2026-40868

CYBERSECURITY BRIEFING NOTE OVERVIEW CVE-2026-40868 affects Kyverno versions prior to 1.16.4, a policy engine used in cloud native environments. The vulnerability exists in the apiCall service call helper, which automatically injects the Kyverno controller service account token as an Authorization Bearer token when policies lack explicit authorization headers. Since the service URL is policy-controlled, attackers can exploit this to redirect the token to attacker-controlled endpoints, creating a confused deputy vulnerability. The issue is limited to ClusterPolicy and global context usage, as namespaced policies are blocked by existing gating mechanisms. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.1 (High), indicating significant risk. It requires network access and low privilege credentials to exploit, but demands no user interaction. The attack can result in high confidentiality and integrity impacts by exposing sensitive authentication tokens and potentially allowing unauthorized API calls. The EPSS score of 0.00031 suggests current exploit likelihood is low, though this metric may not reflect future threats. EXPLOITATION STATUS The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation. No public exploit code availability has been reported. Community attention appears limited based on inactive status on vulnerability tracking systems. However, organizations running Kyverno versions prior to 1.16.4 should prioritize patching given the token exposure risk and relative ease of exploitation for privileged users.