PT-2026-66831 · Banzai Cloud · Vault-Secrets-Webhook

CVE-2026-54725 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions vault-secrets-webhook versions prior to 1.23.1

Description The software reads the vault.security.banzaicloud.io/vault-addr annotation from ConfigMaps or Secrets without validation or allowlisting. When a value prefixed with vault: is present, the admission handler synchronously calls the Vault API at the attacker-supplied address. Because the webhook possesses cluster-wide serviceaccounts/token:create permissions, the vault.security.banzaicloud.io/vault-serviceaccount annotation can be used to fetch a ServiceAccount JWT and send it to the attacker-controlled address. This allows an attacker with permissions to create or update ConfigMaps or Secrets in a watched namespace to perform arbitrary outbound HTTP connections (such as accessing cloud IMDS) and exfiltrate ServiceAccount JWTs to access secrets in Vault.

Technical details include:

• API Endpoints: The webhook makes requests to the address specified in the vault.security.banzaicloud.io/vault-addr annotation, specifically targeting the /v1/auth/<path>/login endpoint.
• Vulnerable Parameters or Variables: vault.security.banzaicloud.io/vault-addr and vault.security.banzaicloud.io/vault-serviceaccount annotations.
• Function Names: parseVaultConfig(), MutateConfigMap(), MutateSecret(), and newVaultClient().

Recommendations Update vault-secrets-webhook to version 1.23.1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-54725

GHSA-R2V3-8GWF-7GHM

Affected Products

Vault-Secrets-Webhook

References · 6

• 🔥 https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54725 · Security Note
• https://osv.dev/vulnerability/GHSA-r2v3-8gwf-7ghm · Vendor Advisory
• https://github.com/bank-vaults/vault-secrets-webhook/commit/76db45976fee0f54cafd94dffa425e6b542f65a0 · Note
• https://github.com/bank-vaults/vault-secrets-webhook/releases/tag/v1.23.1 · Note
• https://github.com/bank-vaults/vault-secrets-webhook · Note