github.com/external-secrets/external-secrets vulnerabilities (Go)

6 vulnerabilities.

• github.com/external-secrets/external-secrets Go External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration CVE-2026-26287 Fix available 7.1 HighOctober 6, 2026
• github.com/external-secrets/external-secrets Go External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore CVE-2026-42875 Fix available 5.3 MediumMay 5, 2026
• github.com/external-secrets/external-secrets Go External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine CVE-2026-34984 Fix available 7.1 HighApril 13, 2026
• github.com/external-secrets/external-secrets Go External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVE-2026-22822 Fix available 9.3 CriticalJanuary 20, 2026
• github.com/external-secrets/external-secrets Go External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access CVE-2025-55196 Fix available 7.1 HighAugust 13, 2025
• github.com/external-secrets/external-secrets Go External Secrets Operator vulnerable to privilege escalation CVE-2024-45041 Fix available 8.3 HighSeptember 9, 2024