110 matches found
GHSA-FCXQ-V2R3-CC8H External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access
Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access
Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...
PT-2025-33101 · External Secrets · External Secrets Operator
Name of the Vulnerable Software and Affected Versions: External Secrets Operator versions 0.15.0 through 0.19.1 Description: A flaw was discovered in the External Secrets Operator where List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply...
GO-2024-3126 External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets
External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets...
External Secrets Operator vulnerable to privilege escalation
Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...
CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: tempo, flux-source-controller, kubescape, opentelemetry-collector, flyte, argo-workflows, argo-events, pulumi, sops, sigstore-scaffolding, chezmoi, spire-server, sqlpad, external-dns, opentelemetry-collector-contrib, flux, fluent-bit-plugin-loki, timestamp-authority,...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: flux-source-controller, kubescape, oauth2-proxy, rabbitmq-messaging-topology-operator, ko, argo-workflows, sops, sigstore-scaffolding, gomplate, dgraph, kube-rbac-proxy, spire-server, aactl, kargo, skopeo, cloudflared, nerdctl, timestamp-authority, tkn, melange, zot,...
