150 matches found
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: scorecard, bom, gitea, kyverno, nfpm, tfsec, teleport, cerbos, witness, kaniko, grype, syft, zarf, xeol, k9s, melange, grafana-alloy, gptscript, flux, guac, kubescape, trivy, osv-scanner, pulumi, flux-source-controller, trufflehog, wolfictl, argocd-image-updater,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: scorecard, bom, gitea, kyverno, nfpm, tfsec, teleport, cerbos, witness, kaniko, grype, syft, zarf, xeol, k9s, melange, grafana-alloy, gptscript, flux, guac, kubescape, trivy, osv-scanner, pulumi, flux-source-controller, trufflehog, wolfictl, argocd-image-updater,...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: scorecard, bom, gitea, kyverno, nfpm, tfsec, teleport, cerbos, witness, kaniko, grype, syft, zarf, xeol, k9s, melange, grafana-alloy, gptscript, flux, guac, kubescape, trivy, osv-scanner, pulumi, flux-source-controller, trufflehog, wolfictl, argocd-image-updater,...
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: scorecard, bom, gitea, kyverno, nfpm, tfsec, teleport, cerbos, witness, kaniko, grype, syft, zarf, xeol, k9s, melange, grafana-alloy, gptscript, flux, guac, kubescape, trivy, osv-scanner, pulumi, flux-source-controller, trufflehog, wolfictl, argocd-image-updater,...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: opentofu, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, docker-cli-buildx, witness, crossplane-provider-aws-cloudformation, grype, zarf, xeol, atlantis, crossplane-provider-aws-iam, guac, crossplane-provider-aws-dynamodb, terraform-provider-azuread,...
GHSA-Q9HV-HPM4-HJ6X vulnerabilities
Vulnerabilities for packages: opentofu, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, docker-cli-buildx, witness, crossplane-provider-aws-cloudformation, grype, zarf, xeol, atlantis, crossplane-provider-aws-iam, guac, crossplane-provider-aws-dynamodb, terraform-provider-azuread,...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: kubevela-fips, flux-image-automation-controller-fips, vault-fips, databricks-cli, crossplane-provider-azure-storage, dagger, witness, rclone, nfpm, flux-helm-controller-fips, crossplane-provider-aws-iam, packer-fips, crossplane-provider-aws-dynamodb-fips,...
SUSE CVE-2026-22822
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
GO-2026-4330 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...
PT-2026-6506
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...
CVE-2026-22822
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
CVE-2026-22822
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
EUVD-2026-3404
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
CVE-2026-22822
CVE-2026-22822 affects the External Secrets Operator. The root issue is the getSecretKey templating function, which in versions starting from 0.20.2 and prior to 1.2.0 allowed cross‑namespace retrieval of secrets via the controller’s roleBinding, bypassing safeguards. This could lead to unauthori...
CVE-2026-22822: Incorrect Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...
GHSA-77V3-R3JW-J2V2 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...