CLEANSTART-2026-TO39207 Security fix for GHSA-gcjh-h69q-9w9g applied in: external-secrets-operator 2.8.0-r1, rancher-agent 2.11.15-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LA75806 Security fix for GHSA-pjcq-xvwq-hhpj applied in: minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, openbao 2.5.4-r1, yunikorn-k8shim 1.8.0-r1, external-secrets-operator-fips 2.4.1-r0

GHSA-pjcq-xvwq-hhpj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GO-2026-6667 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets...

PT-2026-118294

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets...

CLEANSTART-2026-QV19791 Security fix for GHSA-gcjh-h69q-9w9g applied in: external-secrets-operator-fips 2.12.0-r1, flux-helm-controller 1.6.4-r1

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IN42122 Security fix for GHSA-hrxh-6v49-42gf applied in: external-secrets-operator-fips 2.7.0-r1, node-problem-detector 0.8.25-r1

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UL53723 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the external-secrets-operator package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-QV38909 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the external-secrets-operator package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-QF15454 Security fix for GHSA-mpwr-8vm7-h73f applied in: external-secrets-operator-fips 2.7.0-r1

Security vulnerability affects the external-secrets-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RV05686 Security fix for GHSA-cp6g-7hqx-qxhp applied in: external-secrets-operator-fips 2.7.0-r1

Security vulnerability affects the external-secrets-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EU28747 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

Security vulnerability affects the external-secrets-operator-fips package. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS...

PT-2026-117184

Security vulnerability affects the external-secrets-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-117181

Security vulnerability affects the external-secrets-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-26287

A flaw was found in external-secrets. An issue during webhook generator initialization incorrectly clears the label enforcement setting, bypassing provider-side validation. An authenticated user with permissions to create webhook generators can target arbitrary secrets lacking the required label...

CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

EUVD-2026-93468

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the "webhook" generator initialization order incorrectly cleared the label-enforcement flag...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...