Skip to content
OpenAdvisories

Package · Go

github.com/bank-vaults/vault-secrets-webhook

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.6
    CVE-2026-54725

    vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

    vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and Mut…

    bank-vaults vault-secrets-webhook github.com/bank-vaults/vault-secrets-webhook Go