package

Go/github.com/bank-vaults/vault-secrets-webhook

pkg:go/github.com/bank-vaults/vault-secrets-webhook

CRITICAL9.6Go

GHSA-r2v3-8gwf-7ghm· CVE-2026-54725, GO-2026-6160

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Modified: 8/18/2026

—Go

GO-2026-6160· CVE-2026-54725, GHSA-r2v3-8gwf-7ghm

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook

Modified: 8/18/2026