Critical, CVSS 9.6GoAmendedPublished
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
CVE-2026-54725 · GHSA-r2v3-8gwf-7ghm
- Affected
- Go github.com/bank-vaults/vault-secrets-webhook <= 1.22.2
- Fixed in
- 1.23.1· Vendor fix available
- Issue
- The vault-secrets-webhook reads the vault.security.banzaicloud.io/vault-addr annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with vault:, the webhook's admission handler synchronously calls the Vault API at the attacker-supplied address from inside the webhook process during the admission review. The webhook additionally grants serviceaccounts/token:create cluster-wide, and the vault-serviceaccount annotation controls which ServiceAccount's JWT is fetched and sent to that address. An attacker who can create ConfigMaps or Secrets in a watched namespace can cause the webhook process to make arbitrary outbound HTTP connections and exfiltrate ServiceAccount JWTs. Details parseVaultConfig() at pkg/webhook/config.go:102-107 reads VaultAddrAnnotation unconditionally into vaultConfig.Addr: No URL scheme validation, no hostname allowlist, no RFC-1918…
Recommended action: Upgrade to 1.23.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.