CVE-2026-22728

🗓️ 26 Feb 2026 00:50:00Reported by vmwareType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

Bitnami Sealed Secrets rotate can widen scope to cluster-wide via attacker annotations, enabling unauthorized access.

Reporter	Title	Published	Views	Family All 131
ATTACKERKB	CVE-2026-22728	26 Feb 202600:50	–	attackerkb
Chainguard	CVE-2026-22728 vulnerabilities	27 Feb 202619:17	–	cgr
Circl	CVE-2026-22728	26 Feb 202623:40	–	circl
CNNVD	Sealed Secrets 安全漏洞	26 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-22728 sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations	26 Feb 202600:50	–	cvelist
EUVD	EUVD-2026-8795	26 Feb 202622:49	–	euvd
Github Security Blog	Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations	26 Feb 202622:49	–	github
NVD	CVE-2026-22728	26 Feb 202602:16	–	nvd
OSV	BIT-SEALED-SECRETS-2026-22728 Bitnami Sealed Secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations	26 Feb 202609:30	–	osv
OSV	CGA-4JV9-3XGW-GGFC	23 Mar 202604:46	–	osv

[
  {
    "defaultStatus": "unaffected",
    "product": "sealed-secrets",
    "vendor": "Bitnami",
    "versions": [
      {
        "lessThan": "<0.36.0",
        "status": "affected",
        "version": "0.35.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/bitnami-labs/sealed-secrets/security/advisories/GHSA-465p-v42x-3fmj

Parameter	Position	Path	Description	CWE
spec.template.metadata.annotations.sealedsecrets.bitnami.com/cluster-wide	request body	v1/rotate	Rotation endpoint accepts untrusted annotations that can widen sealing scope, enabling cluster-wide access to rotated secrets.	CWE-284

17 Jun 2026 10:20Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.14.9

EPSS0.00352

SSVC

CWE-284