CVE-2026-42875 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...

CVE-2026-42875

External Secrets Operator contains a namespace isolation bypass in CAProvider ConfigMap resolution for SecretStore. Before v2.4.0, Namespaced SecretStore resources using CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set, bypassing th...

External Secrets 授权问题漏洞

External Secrets is an open-source Kubernetes-related application developed by External Secrets. Versions of the External Secrets Operator prior to 2.4.1 had an authorization issue vulnerability. This vulnerability stemmed from the ability for users to create ExternalSecret resources, allowing...

CVE-2026-42875: Improper Authorization

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...

CVE-2026-42876: Improper Authorization

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...

External Secrets 授权问题漏洞

External Secrets is an open-source Kubernetes-related application developed by External Secrets. Versions of External Secrets prior to 2.4.0 had an authorization issue vulnerability. This vulnerability stemmed from the use of CAProvider for the SecretStore resource, allowing it to resolve CA...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via ExternalSecret resource handling for Service Account tokens. A user can impersonate service accounts by crafting ExternalSecret resources that cause the operator to create Secrets populated with long-lived...

ExternalSecrets vulnerable to privilege escalation with secret overwriting

ExternalSecrets allows users to craft Service Account tokens for misconfigured Service Accounts in namespaces the users have access to. Impact A user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate wi...

GHSA-R2PG-R6H7-CRF3 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-34984 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-R2PG-R6H7-CRF3 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

Exposure of Resource to Wrong Sphere

Overview Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the CAProvider configuration process for SecretStore resources when resolving ConfigMaps across namespaces. An attacker can access CA material from another namespace by specifying the...

GHSA-WV26-88M5-6H59 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Impact Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: buildah, external-dns-fips, nerdctl-fips, crossplane-provider-azure-authorization, crossplane-provider-aws-appflow-fips, haproxy-ingress, juicefs, crossplane-provider-azure-servicebus, envoy-ratelimit, kubernetes-csi-driver-nfs-fips, tetragon-fips, kargo, kuma,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: buildah, external-dns-fips, nerdctl-fips, crossplane-provider-azure-authorization, crossplane-provider-aws-appflow-fips, haproxy-ingress, juicefs, crossplane-provider-azure-servicebus, envoy-ratelimit, kubernetes-csi-driver-nfs-fips, tetragon-fips, kargo, kuma,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: step-ca, crossplane-provider-aws-elasticache, datadog-agent, crossplane-provider-aws-sns, mesosphere-vsphere-csi, nerdctl, ko, cilium, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, crossplane-provider-aws-route53, flux-helm-controller,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: step-ca, crossplane-provider-aws-elasticache, datadog-agent, crossplane-provider-aws-sns, mesosphere-vsphere-csi, nerdctl, ko, cilium, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, crossplane-provider-aws-route53, flux-helm-controller,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: telegraf, gitea, kyverno-notation-aws, bento, rancher-agent, cert-manager-cmctl, opentofu, grafana, frp, teleport, trufflehog, terraform, flux, harbor, juicefs, gitlab-runner, kyverno, percona-server-mongodb-operator, spqr, sftpgo-plugin-auth, ratify, seaweedfs,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: telegraf, gitea, kyverno-notation-aws, bento, rancher-agent, cert-manager-cmctl, opentofu, grafana, frp, teleport, trufflehog, terraform, flux, harbor, juicefs, gitlab-runner, kyverno, percona-server-mongodb-operator, spqr, sftpgo-plugin-auth, ratify, seaweedfs,...