TI-2024-30153 CVE-2024-45041 · GHSA-qwgc-rr35-h4x9
External Secrets Operator vulnerable to privilege escalation
Priority HIGH 71
External Secrets Operator is a Kubernetes operator that integrates external secret management systems.
external-secrets
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
external-secrets records in CISA KEVNo external-secrets vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
TI-2024-24309 CVE-2024-36540 · GHSA-h9mr-jrr6-mjrf
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive…
Priority MEDIUM 49
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
TI-2026-18338 CVE-2026-22822 · GHSA-77v3-r3jw-j2v2
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
Priority MEDIUM 41
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
TI-2025-38481 CVE-2025-62159
External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval
Priority LOW 37
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
TI-2026-31081 CVE-2026-42875 · GHSA-wv26-88m5-6h59
External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
Priority LOW 32
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
Priority LOW 31
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
TI-2026-27206 CVE-2026-34984 · GHSA-r2pg-r6h7-crf3
External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
Priority LOW 31
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
TI-2025-34872 CVE-2025-55196 · GHSA-fcxq-v2r3-cc8h
Improper access control in external-secrets
Priority LOW 31
External Secrets Operator is a Kubernetes operator that integrates external secret management systems.
TI-2026-31082 CVE-2026-42876 · GHSA-fq7h-9x26-6j22
External Secrets Operator: Privilege escalation with secret overwriting
Priority LOW 22
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.