bank-vaults vault-secrets-webhook (vault-addr / vault-serviceaccount pod annotations): parseVaultConfig() honours a

Impact

parseVaultConfig() honours a pod-level vault.security.banzaicloud.io/vault-addr annotation, so anyone who can create a pod, ConfigMap or Secret that the webhook mutates can point it at a Vault address they control. Combined with the vault-serviceaccount annotation, the webhook then sends a ServiceAccount JWT of the attacker's choosing to that address. On a multi-tenant GPU cluster the webhook runs with cluster-wide reach, so the tokens it can be made to present are not limited to the requesting tenant's namespace; a captured JWT can be replayed against the real Vault to pull secrets belonging to other workloads. NVD gives it 9.6 with a changed scope and no availability impact - this is a credential disclosure and lateral-movement bug, not a crash.

Who can reach it

Authenticated tenant with permission to create pods (or ConfigMaps/Secrets) in a namespace the webhook mutates. No cluster-admin required; the attacker also needs an endpoint the cluster can reach to receive the token, so egress restrictions blunt it.

What to do

Upgrade vault-secrets-webhook to 1.23.1 and restart the webhook deployment - a control-plane pod restart, no node drain and no GPU workload interruption beyond briefly failing mutations if the webhook failure policy is Fail. Before upgrading you can mitigate by blocking the vault-addr and vault-serviceaccount annotations in admission policy and by denying cluster egress from the webhook pod to anything but your Vault. Treat any ServiceAccount whose JWT may have been sent off-cluster as exposed and rotate the Vault roles bound to it.

References

Related entries

• RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they controlCVE-2026-70398 · Red Hat Advanced Cluster Management - multicloud-integrations (GitOpsCluster controller)Critical
• Dokploy: unquoted dockerImage field gives command execution on the build hostCVE-2026-72877 · Dokploy Docker build path (dockerImage field in buildRemoteDocker)Critical
• OpenChoreo cluster-gateway: unauthenticated management API exposes data-plane Kubernetes API and pod execCVE-2026-73843 · OpenChoreo cluster-gateway (agent listener management API)Critical
• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical