A AegiFlow
CRITICALCVSS 9.6EPSS 0.3%

CVE-2026-54725

CVE-2026-54725 updated by NVD

Published
2026-07-31
Modified
2026-09-12
EPSS percentile
25%
Sources
github-advisory, nvd

Summary

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.

Affected packages

EcosystemPackageAffected versionsFixed versions
Gogithub.com/bank-vaults/vault-secrets-webhook1.23.1

Remediation: Upgrade to 1.23.1 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.