CVE-2026-42875

A flaw was found in External Secrets Operator. Namespaced SecretStore resources configured with CAProvider of type ConfigMap, when caProvider.namespace is set, could resolve Certificate Authority CA material from other namespaces. This bypasses the intended namespace boundary, potentially allowin...

CVE-2026-42876 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-WV26-88M5-6H59 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-42875 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-FQ7H-9X26-6J22 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-FQ7H-9X26-6J22 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-42875 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-42876 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-WV26-88M5-6H59 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: wolfictl, rancher-fleet, teleport, flux, cerbos, kubevela, kyverno, grafana-alloy, gitsign, melange, argocd-image-updater, skaffold, tfsec, trivy-operator, steampipe, zarf, goreleaser, apko, external-secrets-operator, gitaly, pulumi-kubernetes-operator, zot, trivy,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: wolfictl, rancher-fleet, teleport, flux, cerbos, kubevela, kyverno, grafana-alloy, gitsign, melange, argocd-image-updater, skaffold, tfsec, trivy-operator, steampipe, zarf, goreleaser, apko, external-secrets-operator, gitaly, pulumi-kubernetes-operator, zot, trivy,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: wolfictl, rancher-fleet, teleport, flux, cerbos, kubevela, kyverno, grafana-alloy, gitsign, melange, argocd-image-updater, skaffold, tfsec, trivy-operator, steampipe, zarf, goreleaser, apko, external-secrets-operator, gitaly, pulumi-kubernetes-operator, zot, trivy,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: wolfictl, rancher-fleet, teleport, flux, cerbos, kubevela, kyverno, grafana-alloy, gitsign, melange, argocd-image-updater, skaffold, tfsec, trivy-operator, steampipe, zarf, goreleaser, apko, external-secrets-operator, gitaly, pulumi-kubernetes-operator, zot, trivy,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, grype, pulumi-language-yaml, argocd-image-updater, grype-db, grype-fips, gomplate, gitlab-runner-fips, zot, cg, chainloop-cli-fips, osv-scanner, argo-events, coder, coder-fips, gitaly-fips, kargo, terragrunt, zarf-fips, apko-fips, cerbos-fips,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, grype, pulumi-language-yaml, argocd-image-updater, grype-db, grype-fips, gomplate, gitlab-runner-fips, zot, cg, chainloop-cli-fips, osv-scanner, argo-events, coder, coder-fips, gitaly-fips, kargo, terragrunt, zarf-fips, apko-fips, cerbos-fips,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, grype, pulumi-language-yaml, argocd-image-updater, grype-db, grype-fips, gomplate, gitlab-runner-fips, zot, cg, chainloop-cli-fips, osv-scanner, argo-events, coder, coder-fips, gitaly-fips, kargo, terragrunt, zarf-fips, apko-fips, cerbos-fips,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, grype, pulumi-language-yaml, argocd-image-updater, grype-db, grype-fips, gomplate, gitlab-runner-fips, zot, cg, chainloop-cli-fips, osv-scanner, argo-events, coder, coder-fips, gitaly-fips, kargo, terragrunt, zarf-fips, apko-fips, cerbos-fips,...

CVE-2026-42875

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...

CVE-2026-42876

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...

CVE-2026-42876 External Secrets Operator: Privilege escalation with secret overwriting

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...