CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-R2PG-R6H7-CRF3 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-WV26-88M5-6H59 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Impact Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-search, db-operator-fips, gatus, crossplane-provider-aws-cloudtrail-fips, crossplane-provider-aws-memorydb, authentik-fips, crossplane-provider-aws-secretsmanager-fips, cert-manager-openshift-routes, modelmesh-runtime-adapter, step-ca, ko,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-search, db-operator-fips, gatus, crossplane-provider-aws-cloudtrail-fips, crossplane-provider-aws-memorydb, authentik-fips, crossplane-provider-aws-secretsmanager-fips, cert-manager-openshift-routes, modelmesh-runtime-adapter, step-ca, ko,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, crossplane-provider-aws-dynamodb, crossplane-provider-aws-cloudfront, datadog-agent, aws-efs-csi-driver, amazon-cloudwatch-agent-operator, kubernetes-csi-node-driver-registrar, crossplane-provider-aws-eks, crossplane-provider-azure-storage, src,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, crossplane-provider-aws-dynamodb, crossplane-provider-aws-cloudfront, datadog-agent, aws-efs-csi-driver, amazon-cloudwatch-agent-operator, kubernetes-csi-node-driver-registrar, crossplane-provider-aws-eks, crossplane-provider-azure-storage, src,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: zot, bento, minio, rancher, teleport, trufflehog, telegraf, opentofu, openbao, rancher-webhook, cert-manager-cmctl, yunikorn-k8shim, rclone, cert-manager-istio-csr, flux-source-controller, spqr, sftpgo-plugin-auth, seaweedfs, k6, external-secrets-operator,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: zot, bento, minio, rancher, teleport, trufflehog, telegraf, opentofu, openbao, rancher-webhook, cert-manager-cmctl, yunikorn-k8shim, rclone, cert-manager-istio-csr, flux-source-controller, spqr, sftpgo-plugin-auth, seaweedfs, k6, external-secrets-operator,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, external-secrets-operator, juicefs, ldap2pg, gitea, spqr, seaweedfs-rocksdb, cert-manager-openshift-routes, gitlab-runner, bento, seaweedfs, trufflehog-fips, packer, flux-source-controller-fips, bento-fips, cert-manager-istio-csr,...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: zarf-fips, terragrunt-fips, syft, argo-workflows, external-secrets-operator, kubescape-server, grype-fips, gitea, gitaly-fips, pulumi, gitlab-runner, pulumi-language-yaml, gptscript, packer, flux-source-controller-fips, trufflehog-fips, cloudbeat-fips,...

CVE-2026-34984

A flaw was found in External Secrets Operator. An attacker with the ability to create or update templated ExternalSecret resources can exploit a vulnerability in the v2 template engine. This flaw allows the attacker to use the getHostByName function to perform controller-side DNS lookups, leading...

CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

EUVD-2026-22190

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984

Summary: External Secrets Operator (ESO) versions 2.2.0 and earlier are vulnerable due to the v2 template engine’s getHostByName exposure in runtime/template/v2/template.go. An attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secre...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...