vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS

• CVE-2026-54725: 0.45% estimated exploitation activity in the next 30 days; percentile 39.05 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The vault-secrets-webhook reads the vault.security.banzaicloud.io/vault-addr annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with vault:, the webhook's admission handler synchronously calls the Vault API at the attacker-supplied address from inside the webhook process during the admission review. The webhook additionally grants serviceaccounts/token:create cluster-wide, and the vault-serviceaccount annotation controls which ServiceAccount's JWT is fetched and sent to that address. An attacker who can create ConfigMaps or Secrets in a watched namespace can cause the webhook process to make arbitrary outbound HTTP connections and exfiltrate ServiceAccount JWTs. Details parseVaultConfig() at pkg/webhook/config.go:102-107 reads VaultAddrAnnotation unconditionally into vaultConfig.Addr: No URL scheme validation, no hostname allowlist, no RFC-1918…

Published by the source

31 Jul 2026, 17:45 UTC

Last modified by the source

18 Aug 2026, 15:00 UTC

Source last checked

26 Oct 2026, 15:28 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-r2v3-8gwf-7ghm

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GO-2026-6160

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-r2v3-8gwf-7ghm

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-54725

Advisory: vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
IDs: CVE-2026-54725, GHSA-r2v3-8gwf-7ghm
Record: https://patchnext.com/advisories/cve-2026-54725 (revision 3, source checked 26 Oct 2026, 15:28 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/bank-vaults/vault-secrets-webhook 1.23.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/bank-vaults/vault-secrets-webhook: affected <= 1.22.2; fixed in 1.23.1

## Suggested inspection (read-only)
- Go github.com/bank-vaults/vault-secrets-webhook: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/bank-vaults/vault-secrets-webhook.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-r2v3-8gwf-7ghm (OSV record GHSA-r2v3-8gwf-7ghm lists affected ranges: Go github.com/bank-vaults/vault-secrets-webhook >=0 <1.23.1 (fixed))
- Verified: https://osv.dev/vulnerability/GO-2026-6160 (OSV record GO-2026-6160 lists affected ranges: Go github.com/bank-vaults/vault-secrets-webhook >=0 <1.23.1 (fixed))
- Verified: https://github.com/advisories/GHSA-r2v3-8gwf-7ghm (GitHub-reviewed advisory GHSA-r2v3-8gwf-7ghm lists affected ranges: Go github.com/bank-vaults/vault-secrets-webhook >=0 <=1.22.2)

Commands are suggestions: review each one before running it.