vault-secrets-webhook Vulnerability: Unauthorized Outbound Connections Risk
An early warning has been issued regarding a vulnerability in vault-secrets-webhook that may allow unauthorized outbound connections and potential exfiltration of ServiceAccount JWTs.
What happened
Reportedly, the vault-secrets-webhook component reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without validation. This appears to enable an attacker who can create ConfigMaps or Secrets in a watched namespace to cause the webhook process to make arbitrary outbound HTTP connections. Furthermore, there is a risk of exfiltrating ServiceAccount JWTs.
This issue is under investigation and the severity is currently assessed as high. The affected component is vault-secrets-webhook (go), with versions introduced from '0' up to and including '1.22.2'. It is recommended to review and restrict the use of the `vault.security.banzaicloud.io/vault-addr` annotation in ConfigMaps and Secrets to mitigate the risk of unauthorized outbound connections.
For more detailed information, primary sources should be consulted. The GitHub Advisory Database entry [GHSA-r2v3-8gwf-7ghm] provides further technical details on the vulnerability.
How 0Day mitigates this
vault-secrets-webhook is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.