Vendor
The vault-secrets-webhook is vulnerable to SSRF and ServiceAccount token theft due to unvalidated annotation handling, allowing attackers to exfiltrate JWTs via unauthorized outbound requests.