Vulnerability · Published Apr 14, 2026 · Assigned by GitHub_M
CVE-2026-34984External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
High 7.1
In plain English
A high-severity information exposure in external-secrets from external-secrets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap() but leaves the getHostByName function accessible to user-controlled templates. Since ESO executes templates within the controller process, an attacker who can create or update templated ExternalSecret resources can invoke controller-side DNS lookups using secret-derived values. This creates a DNS exfiltration primitive, allowing fetched secret material to be leaked via DNS queries without requiring direct outbound network access from the attacker's workload. The impact is a confidentiality issue, particularly in environments where untrusted or lower-trust users can author templated ExternalSecret resources and the controller has DNS resolution capability. This issue has been fixed in version 2.3.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/external-secrets/external-secrets | 1.3.3-0.20260331202714-6800989bdc12 | GHSA-r2pg-r6h7-crf3 |
| Go | github.com/external-secrets/external-secrets | no fix listed | GHSA-r2pg-r6h7-crf3 |
| Go | github.com/external-secrets/external-secrets | 1.3.3-0.20260331202714-6800989bdc12 | GO-2026-5602 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| external-secrets | external-secrets | < 2.3.0 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/external-secrets/external-secrets/security/advisories/GHSA-r2pg-r6h7-crf3 x_refsource_CONFIRM
- https://github.com/external-secrets/external-secrets/commit/6800989bdc12782ca2605d3b8bf7f2876a16551a x_refsource_MISC
- https://github.com/external-secrets/external-secrets/releases/tag/v2.3.0 x_refsource_MISC