CVE-2026-42875 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...

CVE-2026-42875

External Secrets Operator contains a namespace isolation bypass in CAProvider ConfigMap resolution for SecretStore. Before v2.4.0, Namespaced SecretStore resources using CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set, bypassing th...

GHSA-R2PG-R6H7-CRF3 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-R2PG-R6H7-CRF3 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-WV26-88M5-6H59 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Impact Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, crossplane-provider-azure-network, crossplane-provider-azure-netapp, crossplane-provider-azure-servicebus, cephcsi, juicefs, cluster-api-provider-vsphere, crossplane-provider-azure-servicelinker, eksctl, crossplane-provider-aws-s3,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, crossplane-provider-azure-network, crossplane-provider-azure-netapp, crossplane-provider-azure-servicebus, cephcsi, juicefs, cluster-api-provider-vsphere, crossplane-provider-azure-servicelinker, eksctl, crossplane-provider-aws-s3,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, db-operator, argo-rollouts, crossplane-provider-azure-managedidentity, docker-machine-driver-harvester, falco-no-driver, tetragon, osv-scanner, src, crossplane-provider-aws-elasticache, consul-k8s,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, db-operator, argo-rollouts, crossplane-provider-azure-managedidentity, docker-machine-driver-harvester, falco-no-driver, tetragon, osv-scanner, src, crossplane-provider-aws-elasticache, consul-k8s,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: harbor, yunikorn-k8shim, juicefs, rancher-webhook, teleport, spqr, k6, zot, rclone, external-secrets-operator, minio, cert-manager-cmctl, dex, seaweedfs, cert-manager, gitlab-runner, opentofu, xeol, trufflehog, gitea, kyverno-notation-aws, openbao, ratify, nuclei,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: harbor, yunikorn-k8shim, juicefs, rancher-webhook, teleport, spqr, k6, zot, rclone, external-secrets-operator, minio, cert-manager-cmctl, dex, seaweedfs, cert-manager, gitlab-runner, opentofu, xeol, trufflehog, gitea, kyverno-notation-aws, openbao, ratify, nuclei,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: flux-source-controller, minio, zitadel, packer, gitlab-runner-fips, versitygw, juicefs, dex-fips, kyverno-notation-aws-fips, opentofu-fips, gitea, gitea-fips, trufflehog, cert-manager-google-cas-issuer-fips, bento-fips, cloudbeat-fips, xeol-fips, agentbeat-fips,...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: flux-source-controller, grafana-alloy-fips, src-fingerprint-fips, kaniko, packer, wolfictl, gitlab-runner-fips, bom, gomplate, skaffold-fips, gitea, gitea-fips, grype-fips, trufflehog, chainctl-fips, pulumi, chainctl, cloudbeat-fips, gitlab-rails-ce-fips, kubevela,...

CVE-2026-34984

A flaw was found in External Secrets Operator. An attacker with the ability to create or update templated ExternalSecret resources can exploit a vulnerability in the v2 template engine. This flaw allows the attacker to use the getHostByName function to perform controller-side DNS lookups, leading...

CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...