PkgSeer

Vulnerability GO-2026-5602

Unknown

3 months ago

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets

v0.1.0-esoctl - v1.3.2

Summary

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets

Details

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

v0.10.0 - v1.3.1 GHSA-q7hv-xx6h-q2x8

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets

v0.1.0-esoctl - v1.3.2 GO-2026-5723

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

v0.1.0-esoctl - v1.3.2 GHSA-wv26-88m5-6h59

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

v0.1.0-esoctl - v1.3.2 GHSA-r2pg-r6h7-crf3

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

v0.20.2 - v1.1.1 GO-2026-4330

View all vulnerabilities for these packages

Impacted packages

github.com/external-secrets/external-secrets

Timeline

Published

3 months ago

Last Modified

3 months ago