132 matches found
CVE-2025-55196
External Secrets Operator (github.com/external-secrets/external-secrets) contains a vulnerability in versions 0.15.0–0.19.1 where PushSecret List() calls on Kubernetes Secret and SecretStore resources ignore namespace selectors. This allows an attacker who can create or update PushSecret resource...
CVE-2025-55196 External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access
Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...
GHSA-FCXQ-V2R3-CC8H External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access
Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...
PT-2025-33101
Name of the Vulnerable Software and Affected Versions: External Secrets Operator versions 0.15.0 through 0.19.1 Description: A flaw was discovered in the External Secrets Operator where List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply...
GO-2024-3126 External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets
External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets...
External Secrets Operator vulnerable to privilege escalation
Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...
CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: terragrunt, step-ca, goreleaser, policy-controller, restic, sops, trivy, harbor-registry, sigstore-scaffolding, zot, pulumi, opentelemetry-collector-contrib, druid, airflow, flux-kustomize-controller, guac, cortex, py3-cassandra-medusa, grafana-mimir, rclone, velero,...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: terragrunt, gomplate, kots, skopeo, step-ca, kubernetes-dashboard, goreleaser, policy-controller, apko, sops, oauth2-proxy, sigstore-scaffolding, cloudflared, temporal-ui-server, zot, flux-kustomize-controller, guac, melange, grpc-health-probe, aactl, kargo, dgraph,...
