CVE-2026-54725 bank-vaults CVE debrief

Who should care

Organizations using vault-secrets-webhook, especially those handling sensitive ServiceAccount JWTs or integrating with Vault services, should prioritize mitigation of this critical vulnerability. This includes verifying configurations, ensuring version 1.23.1 or later is running, and reviewing configurations for vault.security.banzaicloud.io/vault-addr and vault.security.banzaicloud.io/vault-serviceaccount annotations. Monitoring for unusual ServiceAccount JWT usage is also recommended. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions to protect their systems and assets. Additionally, operators and platform teams should review the configurations and ensure that the necessary mitigations are in place to prevent exploitation of this vulnerability. This may involve coordinating with security teams to implement compensating controls and monitoring for potential security incidents related to this vulnerability. Asset inventory and change management processes should also be reviewed to ensure that affected systems are properly tracked and updated. Overall, a coordinated effort across multiple teams is necessary to fully address this critical vulnerability and minimize potential risks to the organization. The CVE record was published on 2026-07-31T18:17:17.013Z and has not been modified since then, indicating that this is a confirmed issue that requires immediate attention from affected organizations. The NVD and CVE.org records provide further details on the vulnerability and its potential impact, which should be reviewed by relevant teams to ensure a comprehensive understanding of the issue and its implications for the organization. By prioritizing mitigation and taking proactive steps to protect their systems, organizations can reduce the risk of exploitation and minimize potential damage from this critical vulnerability. This requires a proactive and coordinated approach to vulnerability management, involving multiple teams and stakeholders across the organization. The goal is to ensure that all affected systems are properly secured and that the organization is well-prepared to respond to and

Technical summary

The vault-secrets-webhook has a critical vulnerability (CVE-2026-54725) due to improper handling of Vault addresses and ServiceAccount JWTs. The issue is fixed in version 1.23.1. The vulnerability allows potential exposure of ServiceAccount JWTs to attacker-controlled Vault addresses. This issue arises from the vault-secrets-webhook's handling of the vault.security.banzaicloud.io/vault-addr annotation and the vault.security.banzaicloud.io/vault-serviceaccount, which can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address.

Defensive priority

Organizations using vault-secrets-webhook should verify their configurations and ensure they are running version 1.23.1 or later to mitigate this critical vulnerability.

Recommended defensive actions

• Verify and upgrade vault-secrets-webhook to version 1.23.1 or later
• Review configurations for vault.security.banzaicloud.io/vault-addr and vault.security.banzaicloud.io/vault-serviceaccount annotations
• Monitor for unusual ServiceAccount JWT usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-54725 issue arises from the vault-secrets-webhook's handling of the vault.security.banzaicloud.io/vault-addr annotation and the vault.security.banzaicloud.io/vault-serviceaccount, which can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This is due to the parseVaultConfig() function in pkg/webhook/config.go and the newVaultClient calls in MutateConfigMap and MutateSecret functions in pkg/webhook/webhook.go. Evidence is based on NVD and CVE.org records.

Official resources