CyberRota Analysis
AI-GeneratedThe vulnerability affects Kubernetes deployments using the vault-secrets-webhook prior to version 1.23.1, allowing unauthorized secret injection into Pods via a misconfigured annotation. This could lead to the exposure of sensitive ServiceAccount JWTs to an attacker-controlled Vault address, posing a significant security risk. Organizations utilizing this webhook should prioritize upgrading to version 1.23.1 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.