Skip to content
OpenAdvisories

Vendor

external-secrets

8 known vulnerabilities.

Products

external-secrets 8
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-42876

    External Secrets Operator: Privilege escalation with secret overwriting

    External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that…

    external-secrets external-secrets github.com/external-secrets/external-secrets/apis Go
  • Medium 5.3
    CVE-2026-42875

    External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

    External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another…

    external-secrets external-secrets github.com/external-secrets/external-secrets Go