A critical server-side request forgery vulnerability in the bank-vaults vault-secrets-webhook allows unauthorized redirection of sensitive service account tokens to external infrastructure.

The vulnerability (CWE-918) originates from improper validation of the vault-addr annotation and service account parameters during the mutation process, enabling an authenticated user to perform server-side request forgery and exfiltrate JWTs to an attacker-controlled endpoint.

This flaw exposes sensitive Kubernetes ServiceAccount tokens, which are frequently used to manage secrets and authorize access to cloud resources. If exploited, an attacker could gain the privileges associated with the service account, leading to lateral movement, data theft, or full cluster compromise. The high CVSS score of 9.6 underscores the significant risk of unauthorized credential exposure within a containerized environment.

Immediate Action: Upgrade the vault-secrets-webhook component to version 1.23.1 or later to implement strict validation of Vault addresses and prevent unauthorized token redirection.

Proactive Monitoring: Monitor Kubernetes audit logs for unusual mutations or requests involving unexpected Vault service addresses or unauthorized service account token activity.

Compensating Controls: Implement network policies to restrict the webhook and associated pods from communicating with unauthorized or external IP ranges, effectively limiting the scope of potential SSRF attacks.

Public Exploit Available: No

Given the availability of a proof-of-concept and the high impact on cluster security, administrators must treat this as a priority item. Applying the update to 1.23.1 is the only definitive way to close the SSRF vector and secure your Kubernetes secrets workflow.