176 matches found
CVE-2026-42876
External Secrets Operator (ESO) vulnerability where a user with permission to create ExternalSecret resources can trigger creation of a Secret populated with a long‑lived token for a service account, enabling impersonation of that service account in the namespace. This privilege escalation is pos...
CVE-2026-42876
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...
CVE-2026-42876 External Secrets Operator: Privilege escalation with secret overwriting
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...
CVE-2026-42876 External Secrets Operator: Privilege escalation with secret overwriting
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...
CVE-2026-42875 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...
CVE-2026-42875 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...
CVE-2026-42875
External Secrets Operator contains a namespace isolation bypass in CAProvider ConfigMap resolution for SecretStore. Before v2.4.0, Namespaced SecretStore resources using CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set, bypassing th...
CVE-2026-42875: Improper Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...
CVE-2026-42876: Improper Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...
GHSA-R2PG-R6H7-CRF3 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-34984 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-34984 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-R2PG-R6H7-CRF3 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
GHSA-WV26-88M5-6H59 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
Impact Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA...
CVE-2026-29181 vulnerabilities
Vulnerabilities for packages: crossplane-provider-family-aws-fips, crossplane-provider-aws-appflow-fips, crossplane-provider-kubernetes-fips, crossplane-provider-aws-secretsmanager-fips, tetragon, gitlab-cng-fips, crossplane-provider-aws-cognitoidp-fips, gitlab-runner,...
GHSA-MH2Q-Q3FH-2475 vulnerabilities
Vulnerabilities for packages: crossplane-provider-family-aws-fips, crossplane-provider-aws-appflow-fips, crossplane-provider-kubernetes-fips, crossplane-provider-aws-secretsmanager-fips, tetragon, gitlab-cng-fips, crossplane-provider-aws-cognitoidp-fips, gitlab-runner,...
CVE-2026-29181 vulnerabilities
Vulnerabilities for packages: istio, undock, rancher-webhook, dex, k3d, slsa-verifier, step-issuer, cadvisor, kubernetes-csi-livenessprobe, metallb, argo-rollouts, cluster-api-provider-vsphere, crossplane-provider-azure-authorization, db-operator, cloudflared, nerdctl,...
GHSA-MH2Q-Q3FH-2475 vulnerabilities
Vulnerabilities for packages: istio, undock, rancher-webhook, dex, k3d, slsa-verifier, step-issuer, cadvisor, kubernetes-csi-livenessprobe, metallb, argo-rollouts, cluster-api-provider-vsphere, crossplane-provider-azure-authorization, db-operator, cloudflared, nerdctl,...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: zot, rancher-webhook, external-secrets-operator, yunikorn-k8shim, gitea, juicefs, dex, cert-manager-cmctl, grafana, frp, gitlab-runner, kyverno, xeol, flux, terraform, minio, rancher, rclone, bento, sftpgo-plugin-auth, flux-source-controller, rancher-agent,...
GHSA-PJCQ-XVWQ-HHPJ vulnerabilities
Vulnerabilities for packages: zot, rancher-webhook, external-secrets-operator, yunikorn-k8shim, gitea, juicefs, dex, cert-manager-cmctl, grafana, frp, gitlab-runner, kyverno, xeol, flux, terraform, minio, rancher, rclone, bento, sftpgo-plugin-auth, flux-source-controller, rancher-agent,...