PT-2026-80401 · Go · Github.Com/Bank-Vaults/Vault-Secrets-Webhook
Published
2026-08-18
·
Updated
2026-08-18
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Github.Com/Bank-Vaults/Vault-Secrets-Webhook