CVE-2026-49265

creationtimestamp| type| source ---|---|--- 2026-09-28 09:17:11+00:00| published-proof-of-concept| https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv 2026-10-13 15:58:19+00:00| seen| https://infosec.exchange/users/cve/statuses/117434423657230808...

GO-2026-6160 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...

PT-2026-80401

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...

EUVD-2026-51591

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...