What’s Vulnerable › Products

external-secrets vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your external-secrets version is affected

Latest external-secrets vulnerabilities

• CVE-2026-26287 — External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration (CVSS 7.1)
• CVE-2026-42876 — External Secrets Operator: Privilege escalation with secret overwriting (CVSS 4.9)
• CVE-2026-42875 — External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore (CVSS 5.3)
• CVE-2026-34984 — External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine (CVSS 6.5)
• CVE-2026-22822 — External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function (CVSS 8.8)
• CVE-2025-62159 — External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval (CVSS 8.7)
• CVE-2025-55196 — External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access (CVSS 7.1)
• CVE-2024-45041 — External Secrets Operator vulnerable to privilege escalation (CVSS 8.8)
• CVE-2024-36540 — (CVSS 9.8)