A vulnerability in vault-secrets-webhook, a Kubernetes mutating webhook for direct secret injection into Pods, allows an attacker to exfiltrate ServiceAccount JWTs. Prior to version 1.23.1, the parseVaultConfig() function in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation without sufficient validation. The MutateConfigMap and MutateSecret functions call newVaultClient, which can be directed to an attacker-controlled Vault address via the vault.security.banzaicloud.io/vault-serviceaccount annotation. This allows a malicious actor to receive ServiceAccount JWTs, potentially compromising Kubernetes cluster authentication and authorization. The vulnerability affects all versions prior to 1.23.1. The fix was released in version 1.23.1 of vault-secrets-webhook by bank-vaults. Organizations using this webhook should upgrade immediately to prevent credential theft and potential cluster compromise.