CVE-2026-54725

CRITICAL · 9.6

hype LIKELY HACK · 72 hack

Real vuln with same-day patch; credible defender chatter; no KEV yet or in-the-wild reports visible.

What: SSRF in vault-secrets-webhook (Kubernetes mutating webhook) allows attackers to redirect Vault client connections to attacker-controlled addresses and exfiltrate ServiceAccount JWTs. CVSS 9.6 CRITICAL.

Why it matters: Fresh disclosure (today); affects Kubernetes clusters using bank-vaults for secret injection up to v1.22.2. Requires only ConfigMap/Secret creation (low privilege), enabling ServiceAccount token theft and Vault credential compromise. Patch available immediately in v1.23.1.

Where it's seen: Social posts flagging urgent upgrade requirement; threat radar coverage; no KEV listing yet but real advisory chain present (vendor patch exists same day as publication).

RISK: CRITICAL — SSRF + JWT exfiltration in widely-used K8s secret injection component; low barrier to exploit.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 7/31/2026, 9:43:09 PM

Description

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.

CVSS 3.1 breakdown

Exploitability 3.1 · Impact 5.8

vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack vector: Network
Complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

Weaknesses

CWE-918

References

Other · 4