[{"uuid":"GSA_kwCzR0hTQS1xN2h2LXh4NmgtcTJ4OM4AB7yN","url":"https://github.com/advisories/GHSA-q7hv-xx6h-q2x8","title":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration","description":"## Summary\nA bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`.\n\n## Impact\nA user with the permission to create webhook generator can set the webhook generator to a victim' secret (which was not previously labelled for webhook's use), and exfiltrate it to a malicious URL.\n\n## Mitigations\nUntil you upgrade, you can reduce risk by:\n- disabling webhook generators if not needed (or denying `generators.external-secrets.io/v1alpha1` `Webhook` via an admission policy);\n- restricting RBAC: limit who can create generators of kind `Webhook`;\n- enforcing an admission policy (OPA Gatekeeper / Kyverno) requiring referenced secrets to be labeled `external-secrets.io/type=webhook`;\n- restricting egress from external-secrets controller pods to an allowlist (kubernetes `NetworkPolicy` / service mesh egress policy).\n\n## References\n- PR #5901 (fix: webhook initialization order)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-06T15:29:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8","https://github.com/external-secrets/external-secrets/pull/5901","https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba","https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2","https://github.com/advisories/GHSA-q7hv-xx6h-q2x8"],"source_kind":"github","identifiers":["GHSA-q7hv-xx6h-q2x8","CVE-2026-26287"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-06T16:00:13.744Z","updated_at":"2026-10-16T06:00:36.414Z","epss_percentage":0.00244,"epss_percentile":0.14538,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xN2h2LXh4NmgtcTJ4OM4AB7yN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xN2h2LXh4NmgtcTJ4OM4AB7yN","packages":[{"ecosystem":"go","package_name":"github.com/external-secrets/external-secrets","versions":[{"first_patched_version":"1.3.2","vulnerable_version_range":"\u003e= 0.10.0, \u003c 1.3.2"}],"purl":"pkg:go/github.com%2Fexternal-secrets%2Fexternal-secrets"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xN2h2LXh4NmgtcTJ4OM4AB7yN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13djI2LTg4bTUtNmg1Oc4ABWMS","url":"https://github.com/advisories/GHSA-wv26-88m5-6h59","title":"External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore","description":"### Impact\n\nNamespaced SecretStore resources that used CAProvider with type `ConfigMap` could resolve CA material from another namespace when `caProvider.namespace` was set. \nThis bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. \n\nThe accessible data is used as CA validation material, hence it is not directly exposed.\n\nImpact:\n- Direct data exfiltration risk: low\n- Existence disclosure: an attacker can infer whether a target ConfigMap/key exists in another namespace.\n- Trust-boundary violation: a tenant can make its SecretStore consume CA material owned by another namespace.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-05-05T18:37:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-wv26-88m5-6h59","https://nvd.nist.gov/vuln/detail/CVE-2026-42875","https://github.com/advisories/GHSA-wv26-88m5-6h59"],"source_kind":"github","identifiers":["GHSA-wv26-88m5-6h59","CVE-2026-42875"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-05T19:00:08.699Z","updated_at":"2026-10-16T06:03:46.604Z","epss_percentage":0.00372,"epss_percentile":0.29527,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13djI2LTg4bTUtNmg1Oc4ABWMS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13djI2LTg4bTUtNmg1Oc4ABWMS","packages":[{"ecosystem":"go","package_name":"github.com/external-secrets/external-secrets","versions":[{"first_patched_version":"2.4.0","vulnerable_version_range":"\u003c 2.4.0"}],"purl":"pkg:go/github.com%2Fexternal-secrets%2Fexternal-secrets"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13djI2LTg4bTUtNmg1Oc4ABWMS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yMnBnLXI2aDctY3JmM84ABVLI","url":"https://github.com/advisories/GHSA-r2pg-r6h7-crf3","title":"External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine","description":"## Summary\n\nThe v2 template engine in `runtime/template/v2/template.go` imports Sprig’s `TxtFuncMap()` and removes `env` and `expandenv`, but leaves `getHostByName` available to user-controlled  templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secret-derived values, creating a DNS exfiltration primitive.\n\n### Impact\nThis is a confidentiality issue. In environments where untrusted or lower-trust users can author templated ExternalSecret resources and the controller can perform DNS resolution, fetched secret material can be exfiltrated through DNS without requiring direct outbound access from the attacker’s workload.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-13T16:36:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-r2pg-r6h7-crf3","https://github.com/external-secrets/external-secrets/commit/6800989bdc12782ca2605d3b8bf7f2876a16551a","https://github.com/external-secrets/external-secrets/releases/tag/v2.3.0","https://nvd.nist.gov/vuln/detail/CVE-2026-34984","https://github.com/advisories/GHSA-r2pg-r6h7-crf3"],"source_kind":"github","identifiers":["GHSA-r2pg-r6h7-crf3","CVE-2026-34984"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-13T17:00:20.961Z","updated_at":"2026-10-22T13:04:21.154Z","epss_percentage":0.00448,"epss_percentile":0.37558,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yMnBnLXI2aDctY3JmM84ABVLI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yMnBnLXI2aDctY3JmM84ABVLI","packages":[{"ecosystem":"go","package_name":"github.com/external-secrets/external-secrets","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.2.0"},{"first_patched_version":"1.3.3-0.20260331202714-6800989bdc12","vulnerable_version_range":"\u003c 1.3.3-0.20260331202714-6800989bdc12"}],"purl":"pkg:go/github.com%2Fexternal-secrets%2Fexternal-secrets"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yMnBnLXI2aDctY3JmM84ABVLI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03N3YzLXIzanctajJ2Ms4ABRSC","url":"https://github.com/advisories/GHSA-77v3-r3jw-j2v2","title":"External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function","description":"### Summary\n\nThe `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms.\n\nThis function was completely removed, as everything done with that templating function can be done in a different way while respecting our safeguards (for example, using `sourceRef` like explained here: https://github.com/external-secrets/external-secrets/issues/5690#issuecomment-3630977865)\n\n### Impact\n- Cross-namespace secret access: Attackers or misconfigured resources could retrieve secrets from namespaces other than the one intended.\n- privilege escalation: Unauthorized access to secrets could lead to privilege escalation, data exfiltration, or compromise of service accounts and credentials.\n\n### Resolution\n\nWe removed the incriminated templating function from our codebase. All users should upgrade to the latest version containing this fix.\n\n### Workarounds\n\nUse a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.\n\n### Details\n\nSee also:\n- https://github.com/external-secrets/external-secrets/issues/5690\n- https://github.com/external-secrets/external-secrets/pull/3895","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-01-20T16:37:18.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2","https://github.com/external-secrets/external-secrets/issues/5690","https://github.com/external-secrets/external-secrets/pull/3895","https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb","https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0","https://nvd.nist.gov/vuln/detail/CVE-2026-22822","https://github.com/advisories/GHSA-77v3-r3jw-j2v2"],"source_kind":"github","identifiers":["GHSA-77v3-r3jw-j2v2","CVE-2026-22822"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-20T17:00:07.978Z","updated_at":"2026-10-18T11:13:54.162Z","epss_percentage":0.00192,"epss_percentile":0.0824,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03N3YzLXIzanctajJ2Ms4ABRSC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03N3YzLXIzanctajJ2Ms4ABRSC","packages":[{"ecosystem":"go","package_name":"github.com/external-secrets/external-secrets","versions":[{"first_patched_version":"1.2.0","vulnerable_version_range":"\u003e= 0.20.2, \u003c 1.2.0"}],"purl":"pkg:go/github.com%2Fexternal-secrets%2Fexternal-secrets"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03N3YzLXIzanctajJ2Ms4ABRSC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mY3hxLXYycjMtY2M4aM4ABLCd","url":"https://github.com/advisories/GHSA-fcxq-v2r3-cc8h","title":"External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access","description":"## Summary\nA vulnerability was discovered in the External Secrets Operator where the `List()` calls for Kubernetes Secret and SecretStore resources performed by the `PushSecret` controller did not apply a namespace selector.  \nThis flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions.\n\n---\n\n## Impact\nAn attacker with the ability to create or update `PushSecret` resources and control `SecretStore` configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces.  \nThis could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster.\n\n---\n\n## Exploitability\nTo exploit this vulnerability, an attacker must:\n\n1. Have permissions to create or update `PushSecret` resources.\n2. Control one or more `SecretStore` resources.\n\nWith these conditions met, the attacker could leverage label selectors to list secrets from any namespace and retrieve their contents.\n\n---\n\n## Affected Versions\n- **Vulnerable:** v0.15.0 – v0.19.1  \n- **Not Vulnerable:** v0.19.2 and later  \n\n---\n\n## Fix\nThe vulnerability was addressed in v0.19.2 by adding namespace restrictions to the `List()` calls for both `PushSecret` and `SecretStore` controllers.  \nThis ensures that only secrets in the intended namespace are accessible.\n\nRelevant fixes:\n- [#5133](https://github.com/external-secrets/external-secrets/pull/5133) – Enforce namespace selector for PushSecret `List()` calls  \n- [#5109](https://github.com/external-secrets/external-secrets/pull/5109) – Enforce namespace selector for SecretStore `List()` calls  \n\n---\n\n## Mitigation\nIf upgrading to v0.19.2 or later is not immediately possible, the following mitigations are recommended:\n\n- Restrict RBAC permissions so that only trusted service accounts can create or update `PushSecret` and `SecretStore` resources.  \n- Audit existing `PushSecret` and `SecretStore` resources to ensure they are controlled by trusted parties.  \n- Review Network Policies to prevent data exfiltration\n\n---\n\n## Credit\nThis vulnerability was reported by @gracedo and @moolen","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-08-13T19:45:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h","https://github.com/external-secrets/external-secrets/pull/5109","https://github.com/external-secrets/external-secrets/pull/5133","https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d","https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1","https://nvd.nist.gov/vuln/detail/CVE-2025-55196","https://github.com/advisories/GHSA-fcxq-v2r3-cc8h"],"source_kind":"github","identifiers":["GHSA-fcxq-v2r3-cc8h","CVE-2025-55196"],"repository_url":"https://github.com/external-secrets/external-secrets","blast_radius":4.962687030785734,"created_at":"2025-08-13T20:09:13.828Z","updated_at":"2026-10-22T13:06:58.932Z","epss_percentage":0.0037,"epss_percentile":0.29526,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mY3hxLXYycjMtY2M4aM4ABLCd","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mY3hxLXYycjMtY2M4aM4ABLCd","packages":[{"ecosystem":"go","package_name":"github.com/external-secrets/external-secrets","versions":[{"first_patched_version":"0.19.2","vulnerable_version_range":"\u003e= 0.15.0, \u003c 0.19.2"}],"purl":"pkg:go/github.com%2Fexternal-secrets%2Fexternal-secrets"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mY3hxLXYycjMtY2M4aM4ABLCd/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xd2djLXJyMzUtaDR4Oc4AA_YS","url":"https://github.com/advisories/GHSA-qwgc-rr35-h4x9","title":"External Secrets Operator vulnerable to privilege escalation","description":"### Details\nThe external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has \"get/list\" verbs of secrets resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49). It also has path/update verb of validatingwebhookconfigurations resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27). As a result, if a malicious user can access the worker node which has this deployment. he/she can:\n1. For the \"get/list secrets\" permission, he/she can abuse the SA token of this deployment to retrieve or get ALL secrets in the whole cluster, including the cluster-admin secret if created. After that, he/she can abuse the cluster-admin secret to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.\n\n2. For the patch/update verb of validatingwebhookconfigurations, the malicious user can abuse these permissions to get sensitive data or lanuch DoS attacks:\n\nFor the privilege escalation attack, by updating/patching a Webhook to make it listen to Secret update operations, the attacker can capture and log all data from requests attempting to update Secrets. More specifically, when a Secret is updated, this Webhook sends the request data to the logging-service, which can then log the content of the Secret. This way, an attacker could indirectly gain access to the full contents of the Secret.\n\nFor the DoS attack, by updating/patching a Webhook, and making it deny all Pod create and update requests, the attacker can prevent any new Pods from being created or existing Pods from being updated, resulting in a Denial of Service (DoS) attack.\n\n### PoC\nPlease see the \"Details\" section\n\n### Impact\nPrivilege escalation","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-09-09T18:16:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9","https://nvd.nist.gov/vuln/detail/CVE-2024-45041","https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35","https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c","https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27","https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49","https://pkg.go.dev/vuln/GO-2024-3126","https://github.com/advisories/GHSA-qwgc-rr35-h4x9"],"source_kind":"github","identifiers":["GHSA-qwgc-rr35-h4x9","CVE-2024-45041"],"repository_url":"https://github.com/external-secrets/external-secrets","blast_radius":5.801451035988957,"created_at":"2024-09-09T19:06:22.315Z","updated_at":"2026-10-22T13:09:02.595Z","epss_percentage":0.00591,"epss_percentile":0.47508,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xd2djLXJyMzUtaDR4Oc4AA_YS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xd2djLXJyMzUtaDR4Oc4AA_YS","packages":[{"ecosystem":"go","package_name":"github.com/external-secrets/external-secrets","versions":[{"first_patched_version":"0.10.2","vulnerable_version_range":"\u003c 0.10.2"}],"purl":"pkg:go/github.com%2Fexternal-secrets%2Fexternal-secrets"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xd2djLXJyMzUtaDR4Oc4AA_YS/related_packages","related_advisories":[]}]