CVE-2026-54725: Bank-Vaults Vault-Secrets-Webhook

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.

Affected products

• Bank-Vaults Vault-Secrets-Webhook: before 1.23.1 (fixed in 1.23.1)

Published 2026-07-31. Last modified 2026-09-10.