Eexternal-secrets

Products

Exploited and recent CVEs

• CVE-2026-26287 High 7.1 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration 0.2%
• CVE-2026-42876 Medium 4.9 External Secrets Operator: Privilege escalation with secret overwriting 0.2%
• CVE-2026-42875 Medium 5.3 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore 0.2%
• CVE-2026-34984 High 7.1 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine 0.3%
• CVE-2026-22822 High 8.8 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function 0.2%
• CVE-2025-62159 High 8.7 External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval 0.3%
• CVE-2025-55196 High 7.1 External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access 0.4%
• CVE-2024-45041 High 8.3 External Secrets Operator vulnerable to privilege escalation 0.6%