CVE-2026-54725
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
vault-secrets-webhook versions before 1.23.1 contain a vulnerability that allows sending a ServiceAccount JWT token to an attacker-controlled Vault address. The parseVaultConfig() function accepts the vault.security.banzaicloud.io/vault-addr annotation, and MutateConfigMap and MutateSecret call newVaultClient, which can cause the token to be sent to an unsafe server.
Risk Assessment
An attacker can capture the ServiceAccount JWT token, potentially leading to unauthorized access to Vault and its managed secrets, compromising the entire Kubernetes cluster.
Recommendation
Update vault-secrets-webhook to version 1.23.1 or later. If an update is not possible, avoid using the vault.security.banzaicloud.io/vault-addr annotation with untrusted values.
Original NVD description (English source)
vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.