150 matches found
PT-2025-33101
Name of the Vulnerable Software and Affected Versions: External Secrets Operator versions 0.15.0 through 0.19.1 Description: A flaw was discovered in the External Secrets Operator where List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply...
CVE-2025-55196: Improper Access Control
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...
GO-2024-3126 External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets
External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets...
External Secrets Operator vulnerable to privilege escalation
Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...
CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...
CVE-2024-45041: Improper Privilege Management
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: secrets-store-csi-driver-provider-azure, thanos, sops, airflow, grafana-agent-operator, prometheus-operator, restic, terragrunt, up, wal-g, trino, sqlpad, harbor-registry, zarf, tkn, cosign, opentelemetry-collector, k8sgpt, sigstore-scaffolding, rekor, rclone, trivy,...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: sops, minio, terragrunt, temporal-ui-server, zarf, k3s, cosign, cloudflared, ko, sigstore-scaffolding, rekor, dex, bank-vaults, guac, kubescape, tkn, fulcio, step-ca, weaviate, tekton-chains, flux-source-controller, rabbitmq-messaging-topology-operator, wolfictl,...
