Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-42875External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Medium 5.3

In plain English

A medium-severity security flaw in external-secrets from external-secrets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. This vulnerability is fixed in 2.4.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/external-secrets/external-secrets	2.4.0	GHSA-wv26-88m5-6h59
Go	github.com/external-secrets/external-secrets	no fix listed	GO-2026-5723

Affected products (as reported)

Vendor	Product	Versions
external-secrets	external-secrets	< 2.4.0

Weakness: CWE-285, CWE-668 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/external-secrets/external-secrets/security/advisories/GHSA-wv26-88m5-6h59 x_refsource_CONFIRM