github.com/bank-vaults/vault-secrets-webhook
A Kubernetes mutating webhook that makes direct secret injection into Pods possible.
View on Github
Activity
- Latest release
- 3mo ago
- Total releases
- 12
- Cadence
- ~4 months
- Last 12 months
- 3
Reach
- Stars
- 83
Details
- First release
- Jun 14, 2023
| Version | Released | |
|---|---|---|
v1.23.1
patch
|
v1.23.1
patch
Dependencies (19)
+ 11 more |
|
v1.23.0
minor
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.23.0
minor
Dependencies (19)
+ 11 more |
|
v1.22.2
patch
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.22.2
patch
Dependencies (19)
+ 11 more |
|
v1.22.1
patch
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.22.1
patch
Dependencies (19)
+ 11 more |
|
v1.22.0
minor
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.22.0
minor
Dependencies (19)
+ 11 more |
|
v1.21.4
patch
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.21.4
patch
Dependencies (19)
+ 11 more |
|
v1.21.3
patch
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.21.3
patch
Dependencies (19)
+ 11 more |
|
v1.21.2
patch
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.21.2
patch
Dependencies (20)
+ 12 more |
|
v1.21.1
patch
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.21.1
patch
Dependencies (20)
+ 12 more |
|
v1.21.0
minor
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.21.0
minor
Dependencies (20)
+ 12 more |
|
v1.20.0
initial
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.20.0
initial
Dependencies (25)
+ 17 more |
|
v1.20.0-dev.1
pre
1 CVE
CVE-2026-54725
GO-2026-6160
GHSA-r2v3-8gwf-7ghm
Aug 18, 2026
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook Fixed in
1.23.1
References Updated Aug 18, 2026 · Source: OSV.dev |
v1.20.0-dev.1
pre
Dependencies (25)
+ 17 more |