188 matches found
GHSA-FXCW-H3QJ-8M8P n8n Has External Secrets Authorization Bypass in Credential Saving
Impact An authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the externalSecret:list permission check and allowed access to secrets stored in...
n8n Has External Secrets Authorization Bypass in Credential Saving
Impact An authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the externalSecret:list permission check and allowed access to secrets stored in...
CVE-2026-33722
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the...
CVE-2026-33722 n8n Has External Secrets Authorization Bypass in Credential Saving
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the...
CVE-2026-33722 n8n Has External Secrets Authorization Bypass in Credential Saving
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the...
CVE-2026-33722 n8n Has External Secrets Authorization Bypass in Credential Saving
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the...
CVE-2026-33722
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the...
CVE-2026-33722
CVE-2026-33722 (n8n) : An authenticated-but-low-privilege user could bypass the external secret list permission by referencing a secret by its external name in a credential, gaining plaintext access to secrets in connected vaults. The issue requires an instance with an external secrets vault conf...
PT-2026-28082
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.23 n8n versions prior to 2.6.4 Description An authenticated user lacking the necessary permissions could access secrets stored in connected vaults by referencing them by name when saving credentials. This bypasses t...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: gitea, actions-runner-controller, opentofu, flux-notification-controller, crossplane-provider-aws-kms, flux-helm-controller, crossplane-provider-aws-kinesis, trivy-operator, terraform-provider-azurerm, trufflehog, crossplane-provider-aws-cloudfront,...
GHSA-Q9HV-HPM4-HJ6X vulnerabilities
Vulnerabilities for packages: gitea, actions-runner-controller, opentofu, flux-notification-controller, crossplane-provider-aws-kms, flux-helm-controller, crossplane-provider-aws-kinesis, trivy-operator, terraform-provider-azurerm, trufflehog, crossplane-provider-aws-cloudfront,...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: actions-runner-controller, k9s-fips, nuclei, atlantis, cerbos, hydra, crossplane-provider-aws-efs-fips, pulumi-language-yaml, crossplane-provider-aws-cloudformation, crossplane-provider-aws-cognitoidentity-fips, gitaly, terraform-provider-pagerduty,...
CLEANSTART-2026-JR03360 Within HostnameError
Security vulnerability affects the external-secrets package. Within HostnameError...
CLEANSTART-2026-BS57244 Within HostnameError
Security vulnerability affects the external-secrets package. Within HostnameError...
SUSE CVE-2026-22822
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
GO-2026-4330 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...
PT-2026-6506
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...
CLEANSTART-2026-QJ89068 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process
Multiple security vulnerabilities affect the external-secrets-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...