158 matches found
CLEANSTART-2026-VU72808 Security fixes for CVE-2025-61729, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-39821, CVE-2026-39822, CVE-2026-39883, CVE-2026-42502, CVE-2026-42505, CVE-2026-42506, CVE-2026-46600, CVE-2026-56852, ghsa-hfvc-g4fc-pqhx, ghsa-mh2q-q3fh-2475, ghsa-mpwr-8vm7-h73f, ghsa-pjcq-xvwq-hhpj applied in versions: 1.1.0-r0, 2.4.1-r0, 2.5.0-r0, 2.6.0-r1, 2.6.0-r3
Multiple security vulnerabilities affect the external-secrets-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-PH23874 Security fixes for CVE-2025-61729, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-39821, CVE-2026-39822, CVE-2026-39883, CVE-2026-42502, CVE-2026-42505, CVE-2026-42506, CVE-2026-46600, CVE-2026-56852, ghsa-hfvc-g4fc-pqhx, ghsa-mh2q-q3fh-2475, ghsa-mpwr-8vm7-h73f, ghsa-pjcq-xvwq-hhpj applied in versions: 1.1.0-r0, 2.4.1-r0, 2.5.0-r0, 2.6.0-r1, 2.6.0-r3, 2.7.0-r1
Multiple security vulnerabilities affect the external-secrets-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.0.1
external secrets operator for Red Hat OpenShift 1.0.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: drone-fips, flux-image-automation-controller, trivy-operator-fips, kubernetes, rancher, istio, flux, gatekeeper, opentelemetry-collector, telegraf, trivy, kaf, omnictl-multiarch, gitea, gatekeeper-fips, drone, flux-source-controller, tekton-pipelines, skaffold-fips,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: age, istio, guac, steampipe, dagger, chezmoi, pulumi, telegraf, gptscript, atlantis, cloud-provider-aws, ksops, gitea, apko, osv-scanner, rootlesskit, cert-manager, zarf, buildkitd, skaffold, loki, mattermost, terraform-provider-azurerm, spire-server, tflint,...
GO-2026-5723 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets
External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...
GO-2026-5602 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
CVE-2026-42876
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...
CVE-2026-42875
A flaw was found in External Secrets Operator. Namespaced SecretStore resources configured with CAProvider of type ConfigMap, when caProvider.namespace is set, could resolve Certificate Authority CA material from other namespaces. This bypasses the intended namespace boundary, potentially allowin...
CVE-2026-42875 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-FQ7H-9X26-6J22 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-WV26-88M5-6H59 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-42876 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-42876 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-WV26-88M5-6H59 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-FQ7H-9X26-6J22 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-42875 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-M7CR-M3PV-HGRP vulnerabilities
Vulnerabilities for packages: zot, teleport, pulumi-language-java, k9s, xeol, kargo, kaniko, nuclei, guac, cerbos, trufflehog, witness, gitlab-runner, kots, pulumi-language-dotnet, steampipe, argo-cd, grafana-alloy, dagger, flux-image-automation-controller, gitaly, rancher-fleet, terragrunt, triv...
GHSA-CRHJ-59GH-8X96 vulnerabilities
Vulnerabilities for packages: zot, teleport, pulumi-language-java, k9s, xeol, kargo, kaniko, nuclei, guac, cerbos, trufflehog, witness, gitlab-runner, kots, pulumi-language-dotnet, steampipe, argo-cd, grafana-alloy, dagger, flux-image-automation-controller, gitaly, rancher-fleet, terragrunt, triv...
CVE-2026-45570 vulnerabilities
Vulnerabilities for packages: zot, teleport, pulumi-language-java, k9s, xeol, kargo, kaniko, nuclei, guac, cerbos, trufflehog, witness, gitlab-runner, kots, pulumi-language-dotnet, steampipe, argo-cd, grafana-alloy, dagger, flux-image-automation-controller, gitaly, rancher-fleet, terragrunt, triv...