Vulnerability · Published Feb 26, 2026 · Assigned by vmware
CVE-2026-22728sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations
Medium 4.9
In plain English
A medium-severity improper access control in sealed-secrets from Bitnami. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original "strict" or "namespace-wide" constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/bitnami-labs/sealed-secrets | 0.36.0 | GHSA-465p-v42x-3fmj |
| Go | github.com/bitnami-labs/sealed-secrets | 0.36.0 | GO-2026-4565 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | sealed-secrets | 0.35.0 – before <0.36.0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N