SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-54725

CRITICAL · CVSS 9.6 EPSS 0.33% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-31 · Last synced 2026-08-30

CyberRota Analysis

AI-Generated

The vulnerability affects Kubernetes deployments using the vault-secrets-webhook prior to version 1.23.1, allowing unauthorized secret injection into Pods via a misconfigured annotation. This could lead to the exposure of sensitive ServiceAccount JWTs to an attacker-controlled Vault address, posing a significant security risk. Organizations utilizing this webhook should prioritize upgrading to version 1.23.1 to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-54725
Severity
CRITICAL
CVSS
9.6
EPSS
0.33%
Kubernetes

Original NVD Description

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1.