Critical Severity Vulnerability
This vulnerability has been rated as Critical severity. Immediate action is recommended.
CVE-2026-54725
Critical
Low
Medium
High
Critical
9.6
CVSS Score
Vulnerability Description
vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack Vector
N
Attack Complexity
L
Privileges Required
L
User Interaction
N
Scope
C
Confidentiality
H
Integrity
H
Availability
N
References & Resources
-
https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0security-advisories@github.com
-
https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1security-advisories@github.com
-
https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghmsecurity-advisories@github.com
-
https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity Details
9.6
out of 10.0
Critical
Weakness Type (CWE)
CWE-918
Top 25 #20
Server-Side Request Forgery (SSRF)
- Description
- The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- Typical Severity
- Medium
- OWASP Top 10
- A10:2021-Server-Side Request Forgery (SSRF)
- Abstraction Level
- Base
Key Information
- Published Date
- July 31, 2026
