external-secrets vulnerabilities
8 published CVEs name external-secrets among the affected products.
- 8Published CVEs8 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-26287
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
external-secrets · external-secrets
High7.1 - CVE-2026-42876
External Secrets Operator: Privilege escalation with secret overwriting
external-secrets · external-secrets
Medium4.9 - CVE-2026-42875
External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
external-secrets · external-secrets
Medium5.3 - CVE-2026-34984
External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
external-secrets · external-secrets
High7.1 - CVE-2026-22822
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
external-secrets · external-secrets
Critical9.3 - CVE-2025-62159
External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval
external-secrets · external-secrets
High8.7 - CVE-2025-55196
External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access
external-secrets · external-secrets
High7.1 - CVE-2024-45041
External Secrets Operator vulnerable to privilege escalation
external-secrets · external-secrets
High8.3