GHSA-8wfp-579w-6r25: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)

Kyverno’s apiCall service mode automatically attaches the admission controller’s ServiceAccount (SA) token to outbound HTTP requests. This results in unintended credential exposure when requests are sent to external or attacker-controlled endpoints.

The behavior is insecure-by-default and not documented, enabling token exfiltration without requiring policy authors to explicitly opt in.