vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54725 · Microsoft / collected KEV context

GHSA-r2v3-8gwf-7ghm

GO-2026-6160

cve-program · CVE-2026-54725

• https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm
• https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0
• https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1

nvd · CVE-2026-54725

• https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0
• https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1
• https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm

osv · GHSA-r2v3-8gwf-7ghm

• https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm
• https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0
• https://github.com/bank-vaults/vault-secrets-webhook
• https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1

osv · GO-2026-6160

• https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm
• https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0
• https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1

No related operational record is retained in the current change model.