CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitea, docker-cli-buildx, melange, terraform-provider-pagerduty, pulumi-kubernetes-operator, crossplane-provider-aws-lambda, kyverno, src-fingerprint, scorecard, crossplane-provider-family-aws, crossplane-provider-aws-ec2, openbao, nfpm, crossplane-provider-aws-rds,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: gitea, docker-cli-buildx, melange, terraform-provider-pagerduty, pulumi-kubernetes-operator, crossplane-provider-aws-lambda, kyverno, src-fingerprint, scorecard, crossplane-provider-family-aws, crossplane-provider-aws-ec2, openbao, nfpm, crossplane-provider-aws-rds,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lambda-fips, wolfictl, helm, crossplane-provider-azure-authorization, rancher-fleet, sops, argo-cd, crossplane-provider-aws-kinesis, crossplane-provider-azure-storage, crossplane-provider-aws-kinesis-fips, hydra,...

CLEANSTART-2026-JR03360 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CLEANSTART-2026-BS57244 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

SUSE CVE-2026-22822

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

GO-2026-4330 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

PT-2026-6506

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

CLEANSTART-2026-QJ89068 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Multiple security vulnerabilities affect the external-secrets-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...

CLEANSTART-2026-JM84344 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CLEANSTART-2026-DO54415 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CVE-2026-22822

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-22822

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-22822

CVE-2026-22822 affects the External Secrets Operator. The root issue is the getSecretKey templating function, which in versions starting from 0.20.2 and prior to 1.2.0 allowed cross‑namespace retrieval of secrets via the controller’s roleBinding, bypassing safeguards. This could lead to unauthori...

EUVD-2026-3404

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

External Secrets Security Vulnerabilities

External Secrets is an open-source Kubernetes-related application developed by External Secrets. There were security vulnerabilities in versions 0.20.2 to 1.2.0 of External Secrets. These vulnerabilities stemmed from the getSecretKey template function, which allowed access to secrets across...

CVE-2026-22822: Incorrect Authorization

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...