EUVD-2026-22190

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-34984

Summary: External Secrets Operator (ESO) versions 2.2.0 and earlier are vulnerable due to the v2 template engine’s getHostByName exposure in runtime/template/v2/template.go. An attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secre...

CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

External Secrets 信息泄露漏洞

External Secrets is an open-source Kubernetes-related application developed by External Secrets. Versions of External Secrets 2.2.0 and earlier contain a vulnerability related to information leakage. This vulnerability stems from the v2 template engine not removing the getHostByName function, whi...

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...

GHSA-R2PG-R6H7-CRF3 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...

PT-2026-32571

Name of the Vulnerable Software and Affected Versions External Secrets Operator versions prior to 2.3.0 Description The v2 template engine in runtime/template/v2/template.go removes env and expandenv from TxtFuncMap but leaves the getHostByName function accessible to user-controlled templates...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CLEANSTART-2026-PP64690 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-1229, CVE-2026-25934, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-q9hv-hpm4-hj6x applied in versions: 0.20.4-r1, 0.20.4-r2, 0.20.4-r3

Multiple security vulnerabilities affect the external-secrets-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SW07802 Security fixes for CVE-2025-61729 applied in versions: 1.1.0-r0

Security vulnerability affects the external-secrets package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MX45462 Security fixes for CVE-2025-61729 applied in versions: 1.1.0-r0

Security vulnerability affects the external-secrets package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitaly, dagger, xeol-fips, kyverno-fips, argocd-image-updater, grafana-alloy, flux-source-controller, rancher-fleet, apko-fips, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, wolfictl, argo-events-fips, cerbos, xeol, trivy, gitea-fip...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitaly, dagger, xeol-fips, kyverno-fips, argocd-image-updater, grafana-alloy, flux-source-controller, rancher-fleet, apko-fips, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, wolfictl, argo-events-fips, cerbos, xeol, trivy, gitea-fip...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitaly, dagger, xeol-fips, kyverno-fips, argocd-image-updater, grafana-alloy, flux-source-controller, rancher-fleet, apko-fips, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, wolfictl, argo-events-fips, cerbos, xeol, trivy, gitea-fip...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, chezmoi, gptscript, argo-events, pulumi-language-dotnet, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apko,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, chezmoi, gptscript, argo-events, pulumi-language-dotnet, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apko,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, chezmoi, gptscript, argo-events, pulumi-language-dotnet, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apko,...