External-secrets vulnerabilities

Products

• External-secrets 9
• External Secrets Operator 4

Newest

• external-secrets External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration CVE-2026-26287 Fix available 7.1 HighOctober 6, 2026
• external-secrets External Secrets Operator: Privilege escalation with secret overwriting CVE-2026-42876 Fix available 4.9 MediumMay 8, 2026
• external-secrets External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore CVE-2026-42875 Fix available 5.3 MediumMay 5, 2026
• external-secrets external secrets operator, external-secrets +1 more External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine CVE-2026-34984 Fix available 7.1 HighApril 13, 2026
• external-secrets, external-secrets external secrets operator, red hat external secrets operator for red hat openshift +1 more +3 more External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVE-2026-22822 Fix available 9.3 CriticalJanuary 20, 2026
• external-secrets External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval CVE-2025-62159 8.7 HighOctober 10, 2025
• external-secrets External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access CVE-2025-55196 Fix available 7.1 HighAugust 13, 2025
• external-secrets, external-secrets external secrets operator +1 more External Secrets Operator vulnerable to privilege escalation CVE-2024-45041 Fix available 8.3 HighSeptember 9, 2024
• external-secrets, external-secrets external secrets operator +1 more Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and... CVE-2024-36540 9.8 CriticalJuly 24, 2024