Skip to content

Bank-vaults Vault-secrets-webhook vulnerabilities

bank-vaults vault-secrets-webhookvault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest APICVE-2026-54725Fix available9.6 CriticalJuly 31, 2026