CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-R2PG-R6H7-CRF3 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

Exposure of Resource to Wrong Sphere

Overview Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the CAProvider configuration process for SecretStore resources when resolving ConfigMaps across namespaces. An attacker can access CA material from another namespace by specifying the...

GHSA-WV26-88M5-6H59 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Impact Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: juicefs, crossplane-provider-aws-chime-fips, crossplane-provider-aws-cloudformation, crossplane-provider-azure-servicefabric, amazon-cloudwatch-agent-operator-fips, crossplane-provider-aws-kms, dataplaneapi-fips, consul-k8s-fips, tempo-fips,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: juicefs, crossplane-provider-aws-chime-fips, crossplane-provider-aws-cloudformation, crossplane-provider-azure-servicefabric, amazon-cloudwatch-agent-operator-fips, crossplane-provider-aws-kms, dataplaneapi-fips, consul-k8s-fips, tempo-fips,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, external-dns, mesosphere-vsphere-csi, datadog-agent, crossplane-provider-aws-cloudfront, gitlab-kas, trivy, ko, crossplane-provider-aws-dynamodb, crossplane-provider-aws-sns, slsa-verifier, kubernetes-csi-node-driver-registrar, cilium, rancher-webhoo...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, external-dns, mesosphere-vsphere-csi, datadog-agent, crossplane-provider-aws-cloudfront, gitlab-kas, trivy, ko, crossplane-provider-aws-dynamodb, crossplane-provider-aws-sns, slsa-verifier, kubernetes-csi-node-driver-registrar, cilium, rancher-webhoo...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: frp, cert-manager-csi-driver, trufflehog, gitea, flux-source-controller, nuclei, spqr, terraform, gitlab-runner, cert-manager, opentofu, kyverno-notation-aws, sftpgo-plugin-auth, k6, external-secrets-operator, bento, xeol, rancher-agent, rancher-webhook, teleport, de...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: frp, cert-manager-csi-driver, trufflehog, gitea, flux-source-controller, nuclei, spqr, terraform, gitlab-runner, cert-manager, opentofu, kyverno-notation-aws, sftpgo-plugin-auth, k6, external-secrets-operator, bento, xeol, rancher-agent, rancher-webhook, teleport, de...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: grafana-fips, minio-fips, juicefs, xeol, packer-fips, elastic-agent, spqr, sftpgo-plugin-auth, syncthing-fips, rancher-webhook-fips, rancher-agent, external-secrets-operator-fips, gitlab-runner-fips, cert-manager-fips, xeol-fips, beats, kyverno-fips,...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: grafana-fips, kubevela, pulumi-kubernetes-operator, pulumi, act, xeol, packer-fips, trivy-fips, pulumi-language-dotnet, pulumi-language-java, argocd-image-updater-fips, src-fingerprint, gitaly, external-secrets-operator-fips, gitlab-runner-fips, xeol-fips, cerbos,...

CVE-2026-34984

A flaw was found in External Secrets Operator. An attacker with the ability to create or update templated ExternalSecret resources can exploit a vulnerability in the v2 template engine. This flaw allows the attacker to use the getHostByName function to perform controller-side DNS lookups, leading...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the getHostByName function in the v2 template engine. An attacker can cause sensitive data to be disclosed by crafting or updating templated resources that trigger DNS queries containing secret-derived values fr...

CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984

Summary: External Secrets Operator (ESO) versions 2.2.0 and earlier are vulnerable due to the v2 template engine’s getHostByName exposure in runtime/template/v2/template.go. An attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secre...