1. Kyverno Vulnerability CVE-2026-40868 Enables Confused Deputy Attack via Forced Token Leak
Kyverno, a policy engine widely deployed in cloud native environments, contains a high-severity vulnerability (CVE-2026-40868) that allows an attacker to redirect the Kyverno controller's service account token to an attacker-controlled endpoint. The flaw stems from the apiCall servicecall helper, which implicitly injec...