Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via ExternalSecret resource handling for Service Account tokens. A user can impersonate service accounts by crafting ExternalSecret resources that cause the operator to create Secrets populated with long-lived...

CVE-2026-22822

A flaw was found in the External Secrets Operator. A user with appropriate permissions could exploit a vulnerability in the getSecretKey template function. This function allowed secrets, which are sensitive pieces of information like passwords or API keys, to be retrieved from other isolated...