{"vulnerability": "cve-2026-54725", "sightings": [{"uuid": "dff6ca37-90bf-4e55-be54-99db7aab4576", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54725", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrxjr42xr42o", "content": "CVE-2026-54725 - bank-vaults\nAn attacker can create ConfigMaps or Secrets that cause the Vault webhook to make arbitrary outbound HTTP connections, potentially exfiltrating ServiceAccount JWTs. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bankvaults #Golang #CVE #infosec", "creation_timestamp": "2026-07-31T17:58:05.079072Z"}, {"uuid": "ec207915-c7d6-42ef-b933-3d885a95051c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54725", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrxlgcrm3u2i", "content": "A critical flaw in bank-vaults' Kubernetes secret injector, vault-secrets-webhook (CVSS 9.6), lets anyone who can create a ConfigMap steal ServiceAccount tokens and read HashiCorp Vault secrets.\n\nAffects versions up to 1.22.2.\n\nFix: upgrade to 1.23.1. (CVE-2026-54725)", "creation_timestamp": "2026-07-31T18:27:51.544574Z"}, {"uuid": "fc424d8a-8653-4530-8d62-285ae473bfc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54725", "type": "published-proof-of-concept", "source": "https://github.com/bank-vaults/vault-secrets-webhook/security/advisories/GHSA-r2v3-8gwf-7ghm", "content": "", "creation_timestamp": "2026-07-31T18:35:03.821931Z"}, {"uuid": "c7c69958-544a-4f48-be5b-6f2248f16a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-54725", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrxowcc2lk2h", "content": "CRITICAL SSRF (CVE-2026-54725) in bank-vaults vault-secrets-webhook lets attackers steal ServiceAccount JWTs. Upgrade to 1.23.1 ASAP. \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-54725-cwe-918-server-side-request-forgery-ssrf-in-bank-vaults-vault-secrets-webhook-ec0efb4a3e2ca6ff #OffSeq #Kubernetes...", "creation_timestamp": "2026-07-31T19:30:28.573537Z"}]}