CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

EUVD-2026-93468

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287

The External Secrets Operator is vulnerable to a label enforcement bypass in the webhook generator due to an incorrect initialization order. Specifically, the EnforceLabels flag is incorrectly cleared after being set, causing the provider-side check for the external-secrets.io/type=webhook label ...

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

Summary A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabels after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped and the operation to succeed while it should have failed with secret...

PT-2026-106770

Name of the Vulnerable Software and Affected Versions External Secrets Operator versions 0.10.0 through 1.3.1 Description A bug in the webhook generator initialization order incorrectly clears the EnforceLabels label-enforcement flag after it has been set. This causes the provider-side check for...

CLEANSTART-2026-MV16544 Security fix for CVE-2026-46597 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apko 1.2.13-r0, apko 1.2.2-r2, argo-cd 3.3.5-r1, argo-cd-fips 3.1.14-r2, argo-workflows 4.0.5-r0, authservice 1.1.5-r1, authservice 1.1.6-r1, cadvisor 0.55.1-r1, cadvisor 0.57.0-r0, cadvisor-fips 0.55.1-r0, calico 3.30.7-r2, cert-manager 1.17.4-r2, cert-manager 1.18.6-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cluster-autoscaler 1.35.2-r2, consul 2.0.1-r0, cortex 1.21.0-r2, cosign 3.0.6-r1, crossplane-provider-sql-fips 0.15.0-r3, dynatrace-operator 1.6.3-r1, elastic-beats 8.19.15-r5, elastic-beats 9.2.8-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, flux-image-automation-controller 1.2.1-r1, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.7.1-r3, gostatsd 28.3.0-r2, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, haproxy-ingress 0.14.12-r1, helm 4.0.5-r2, helm-operator 1.42.2-r0, istio 1.28.5-r3, istio 1.29.2-r1, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.30.0-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics-fips 2.18.0-r1, kube-vip 1.1.0-r1, kubernetes 1.36.1-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, local-static-provisioner 2.8.0-r2, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r0, minio-client 0.20250721.052808-r1, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.2.6-r1, mongodb 8.3.2-r1, ollama 0.20.3-r2, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.32.11-r2, opa 1.17.0-r1, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.11.2-r0, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-blackbox-exporter 0.28.0-r2, prometheus-mysqld-exporter 0.15.0-r2, prometheus-node-exporter-fips 1.11.1-r1, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.11.3-r1, prometheus-pushgateway 1.8.0-r1, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter-fips 1.84.0-r0, prometheus-redis-exporter-fips 1.87.0-r3, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, rclone 1.69.0-r3, restic-fips 0.18.1-r7, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r4, sealed-secrets 0.36.6-r1, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, step-ca-fips 0.30.2-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.45.0-r2, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.51.1-r1, terraform 1.14.8-r2, tigera-operator 1.42.0-r0, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.45.0-r1, tkn-fips 0.44.2-r0, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r5, vault 1.21.4-r5, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero 1.18.1-r0, velero-fips 1.18.2-r6, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0

CVE-2026-46597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DH56111 Security fix for CVE-2026-33818 applied in: access-log-exporter 0.1.15-r1, access-log-exporter 0.2.0-r0, access-log-exporter 0.3.20-r0, argo-cd 3.2.12-r5, argo-cd-fips 3.4.7-r3, argo-rollouts-fips 1.9.1-r3, argo-workflows 3.7.17-r3, atlantis-fips 0.47.1-r1, aws-network-policy-agent 1.1.6-r3, boring-registry 0.18.0-r0, boring-registry-fips 0.17.0-r2, boring-registry-fips 0.18.0-r0, cadvisor 0.55.1-r5, cadvisor 0.56.2-r3, cadvisor 0.57.0-r5, cadvisor 0.60.5-r1, calico 3.30.7-r7, calico 3.31.6-r2, calico 3.32.1-r3, cert-manager 1.18.6-r5, cert-manager 1.19.6-r3, cert-manager 1.20.3-r4, cert-manager 1.21.1-r0, cloudnative-pg 1.27.4-r2, cloudnative-pg 1.28.4-r1, cloudnative-pg 1.29.2-r2, cloudnative-pg 1.30.0-r1, configmap-reload 0.15.0-r3, cortex 1.18.1-r5, cortex 1.20.1-r4, cosign 2.6.5-r2, cosign 3.0.6-r2, cosign 3.1.3-r0, dex 2.43.1-r3, dex 2.44.0-r8, dynatrace-operator 1.10.1-r1, dynatrace-operator 1.10.2-r0, dynatrace-operator 1.8.1-r7, elastic-beats 9.2.8-r8, elastic-beats 9.3.8-r1, external-secrets-operator 2.6.0-r5, external-secrets-operator 2.7.0-r3, external-secrets-operator 2.8.0-r2, fluent-operator-fips 3.10.0-r3, fulcio-fips 1.5.1-r3, fulcio-fips 1.6.6-r2, fulcio-fips 1.7.1-r3, git-lfs-fips 3.7.1-r1, gitea 1.26.4-r1, go-discover 0_git20250325-r4, gomplate 4.3.3-r3, gosu 1.19-r5, grafana-org-operator 1.13.0-r2, haproxy-ingress 0.13.19-r2, haproxy-ingress 0.14.12-r3, haproxy-ingress 0.15.4-r5, haproxy-ingress 0.16.1-r5, helm 3.21.4-r2, helm 4.0.5-r6, helm 4.1.4-r3, helm 4.2.3-r1, helm-fips 3.21.4-r0, helm-fips 4.2.4-r0, helm-operator 1.39.2-r2, helm-operator 1.40.0-r2, helm-operator 1.42.2-r4, helm-operator 1.42.3-r3, ingress-nginx-controller 1.12.8-r1, ingress-nginx-controller 1.13.9-r1, ingress-nginx-controller 1.14.5-r4, ingress-nginx-controller 1.15.1-r3, istio 1.29.6-r2, istio 1.30.3-r2, knative-net-istio 1.20.4-r3, knative-net-istio 1.21.4-r3, knative-net-istio 1.22.1-r1, knative-net-istio 1.23.0-r0, knative-serving 1.20.3-r1, knative-serving 1.21.3-r2, knative-serving 1.22.1-r3, knative-serving 1.23.0-r0, kube-metrics-adapter 0.2.9-r1, kube-state-metrics 2.16.0-r10, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-state-metrics-fips 2.20.0-r2, kube-vip 0.9.2-r1, kube-vip 1.0.4-r2, kube-vip 1.1.2-r4, kube-vip-fips 0.9.2-r1, kubernetes 1.33.13-r1, kubernetes 1.34.10-r5, kubernetes 1.35.7-r1, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-dns-node-cache 1.23.1-r1, kubernetes-dns-node-cache 1.24.1-r2, kubernetes-dns-node-cache 1.25.0-r9, kubernetes-dns-node-cache 1.26.8-r7, kustomize-fips 5.8.1-r1, local-path-provisioner-fips 0.0.36-r3, logstash-exporter 1.6.4-r1, logstash-exporter 1.7.1-r2, logstash-exporter 1.8.4-r2, logstash-exporter 1.9.1-r4, logstash-exporter-fips 1.6.4-r1, logstash-exporter-fips 1.7.1-r1, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, memcached-exporter 0.16.0-r2, metallb 0.13.12-r5, metallb 0.14.9-r4, metallb 0.15.3-r2, metallb 0.16.0-r3, minio-operator 6.0.4-r7, minio-operator 7.0.1-r7, minio-operator 7.1.1-r7, mongodb 8.0.29-r0, mongodb 8.1.3-r3, mongodb 8.3.8-r0, nats-streaming 0.22.1-r2, nats-streaming 0.23.2-r2, nats-streaming 0.24.6-r5, nats-streaming 0.25.6-r6, nginx-prometheus-exporter-fips 1.5.3-r1, ollama-fips 0.32.11-r1, ollama-fips 0.32.12-r1, ollama-fips 0.32.14-r1, ollama-fips 0.32.15-r2, opa-fips 1.19.1-r2, opentelemetry-collector-contrib 0.156.0-r0, opentelemetry-collector-contrib-fips 0.158.0-r3, opentelemetry-collector-contrib-fips 0.159.0-r2, prometheus 3.10.0-r8, prometheus 3.11.3-r6, prometheus-alertmanager 0.33.0-r2, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, prometheus-fips 3.12.0-r3, prometheus-mongodb-exporter-fips 0.53.0-r1, prometheus-mysqld-exporter 0.17.2-r5, prometheus-mysqld-exporter 0.18.0-r5, prometheus-mysqld-exporter 0.19.0-r4, prometheus-node-exporter 1.10.2-r4, prometheus-node-exporter 1.11.1-r3, prometheus-node-exporter 1.12.1-r1, prometheus-node-exporter 1.9.1-r4, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.11.1-r2, prometheus-operator 0.90.1-r3, prometheus-operator 0.91.0-r4, prometheus-operator 0.92.1-r2, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r3, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter 1.86.0-r2, prometheus-redis-exporter 1.87.0-r1, prometheus-redis-exporter 1.88.0-r3, prometheus-redis-exporter-fips 1.87.0-r3, prometheus-statsd-exporter 0.27.2-r1, prometheus-statsd-exporter 0.28.0-r3, prometheus-statsd-exporter 0.29.0-r0, rabbitmq-cluster-operator 2.20.1-r6, rabbitmq-cluster-operator 2.21.1-r3, rabbitmq-cluster-operator 2.22.4-r0, rabbitmq-messaging-topology-operator 1.18.3-r4, rabbitmq-messaging-topology-operator 1.19.3-r3, rabbitmq-messaging-topology-operator 1.2.1-r1, rclone 1.72.1-r12, rclone 1.73.5-r6, rclone 1.74.4-r1, renovate 44.31.0-r1, renovate 44.32.5-r2, restic 0.18.1-r5, sealed-secrets 0.35.0-r6, sealed-secrets 0.36.6-r4, sealed-secrets 0.37.0.r2, sealed-secrets 0.38.4-r0, stakater-reloader 1.1.0-r4, stakater-reloader 1.2.1-r3, stakater-reloader-fips 1.4.19-r1, step 0.27.5-r4, step 0.28.7-r5, step 0.29.0-r4, step-issuer 0.10.2-r5, step-issuer 0.11.0-r5, step-issuer 0.9.11-r3, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tekton-pipelines-fips 1.13.1-r2, tekton-pipelines-fips 1.14.0-r4, temporal-server 1.28.4-r2, temporal-server 1.29.7-r1, temporal-server 1.30.5-r1, temporal-server 1.30.6-r3, temporal-ui-server-fips 2.48.4-r1, temporal-ui-server-fips 2.49.1-r1, temporal-ui-server-fips 2.50.1-r1, terraform 1.15.7-r0, tigera-operator 1.42.1-r3, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1, tkn 0.46.0-r1, trino 480-r10, trust-manager 0.21.1-r2, trust-manager 0.22.1-r3, trust-manager 0.23.0-r1, trust-manager 0.24.0-r1, vault 1.19.5-r3, vault 1.20.4-r9, vault 1.21.4-r10, vault 2.0.4-r3, vault-k8s 1.5.0.r3, vault-k8s 1.6.2-r2, vault-k8s 1.7.6-r0, velero 1.15.2-r7, velero 1.17.2-r8, velero 1.18.2-r7, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r4, velero-plugin-for-aws 1.14.2-r1, velero-plugin-for-csi 0.4.3-r5, velero-plugin-for-csi 0.5.1-r4, velero-plugin-for-csi 0.6.3-r3, velero-plugin-for-csi 0.7.1-r5, victoriametrics-operator 0.71.0-r2, victoriametrics-operator-fips 0.69.0-r0, victoriametrics-operator-fips 0.70.1-r0, victoriametrics-operator-fips 0.71.0-r0, wave 0.10.0-r5, wave 0.8.0-r2, wave 0.9.0-r2, wave 011.0-r4, weaviate-fips 1.38.10-r2, weaviate-fips 1.38.11-r2

CVE-2026-33818 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.2.1

external secrets operator for Red Hat OpenShift 1.2.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

GHSA-QC2Q-P7WX-3PX3 vulnerabilities

Vulnerabilities for packages: vcluster, grafana-mimir, kubernetes-csi-external-provisioner, mcp-grafana, helm, gcp-compute-persistent-disk-csi-driver, trillian, istio, falco-exporter, kuma, kubeflow, cerbos, k8s-device-plugin, blob-csi, knative-serving, gitlab-runner, hydra, knative-eventing,...

CVE-2026-84303 vulnerabilities

Vulnerabilities for packages: vcluster, grafana-mimir, kubernetes-csi-external-provisioner, mcp-grafana, helm, gcp-compute-persistent-disk-csi-driver, trillian, istio, falco-exporter, kuma, kubeflow, cerbos, k8s-device-plugin, blob-csi, knative-serving, gitlab-runner, hydra, knative-eventing,...

CLEANSTART-2026-BC74118 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the external-secrets-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See...

CLEANSTART-2026-ZD57800 Security fixes in external-secrets-operator 2.9.0-r0

Package external-secrets-operator version 2.9.0-r0 fixes 1 vulnerabilities: ghsa-gcjh-h69q-9w9g...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, zot, kubernetes-csi-external-health-monitor, metrics-server, tetragon, cloud-provider-gcp-cloud-controller-manager, tkn, descheduler, kyverno-notation-aws, kwok, helm-operator, metallb, kuma, flux-helm-controller, cert-manager-webhook-pdns,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, karma, istio, harbor-registry, s5cmd, sonobuoy, hydra, nsc, keda, traefik, authservice, ollama, otel-cli, grafana, osv-scanner, cert-manager, buildkitd, skaffold, mattermost, nri-elasticsearch, cluster-api-azure-controller, deschedule...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, karma, istio, harbor-registry, s5cmd, sonobuoy, hydra, nsc, keda, traefik, authservice, ollama, otel-cli, grafana, osv-scanner, cert-manager, buildkitd, skaffold, mattermost, nri-elasticsearch, cluster-api-azure-controller, deschedule...

GO-2026-5723 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5377 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5693 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, flux-fips, grafana, kyverno, teleport, external-secrets-operator, guac, upwind-agent, gitaly, argo-cd, terragrunt, grafana-fips, gitlab-rails-ce, flux, nemo, gitlab-rails-ce-fips, terragrunt-fips, argo-cd-fips...