PkgSeer

Vulnerability GO-2026-4330

Unknown

8 months ago

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

v0.20.2 - v1.1.1

Summary

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

Details

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

v0.10.0 - v1.3.1 GHSA-q7hv-xx6h-q2x8

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets

v0.1.0-esoctl - v1.3.2 GO-2026-5723

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets

v0.1.0-esoctl - v1.3.2 GO-2026-5602

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

v0.1.0-esoctl - v1.3.2 GHSA-wv26-88m5-6h59

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

v0.1.0-esoctl - v1.3.2 GHSA-r2pg-r6h7-crf3

View all vulnerabilities for these packages

Impacted packages

github.com/external-secrets/external-secrets

Timeline

Published

8 months ago

Last Modified

5 months ago