{"id":"GO-2026-6160","revision":"11c2526f18634ed6bc4aafc45cb56881","records":[{"revision":"11c2526f18634ed6bc4aafc45cb56881","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6160","aliases":["CVE-2026-54725","GHSA-r2v3-8gwf-7ghm"],"title":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook","description":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:14.3932071+00:00","affected":[{"ecosystem":"Go","name":"github.com/bank-vaults/vault-secrets-webhook","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm","https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0","https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6160","license":"OSV · upstream source license applies","key":"osv:GO-2026-6160","identifiers":["GO-2026-6160","CVE-2026-54725","GHSA-r2v3-8gwf-7ghm"]},"retained":false,"historicalAffected":[]}],"coverage":[]}