Kubeflow Hub server request forgery vulnerability

Kubeflow Hub versions 0.3.17 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from an issue with server-side request forgeing in the modelregistry.kubeflow.org/url annotation. It may allow namespace users to steal the controller ServiceAccount token. By...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...