SSRF in bank-vaults vault-secrets-webhook exposed Kubernetes service account tokens

A high-severity flaw tracked as CVE-2026-54725 affected bank-vaults/vault-secrets-webhook before version 1.23.1, allowing attacker-controlled vault-addr Kubernetes annotations to trigger outbound HTTP requests during admission and send a ServiceAccount JWT to an attacker-controlled endpoint. The issue created a server-side request forgery condition and, in some configurations, could enable cluster-wide service account token theft through the Kubernetes TokenRequest API when the vault-serviceaccount setting was used.

The project fixed the issue in v1.23.1 by no longer trusting object-supplied Vault addresses by default and validating them against an operator-controlled allowlist before any network connection or token minting occurs. The patch also blocks unsafe targets such as metadata endpoints, restricts private-address use unless explicitly allowed, rejects userinfo-bearing addresses, and prevents the vault-skip-verify annotation from disabling TLS verification unless operators explicitly enable that behavior; deployments that relied on per-object Vault address overrides may now be denied at admission time.