TI-2024-30153 CVE-2024-45041 · GHSA-qwgc-rr35-h4x9
External Secrets Operator vulnerable to privilege escalation
Priority HIGH 71
External Secrets Operator is a Kubernetes operator that integrates external secret management systems.
external-secrets
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
external-secrets records in CISA KEVNo external-secrets vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in External Secrets Operator · all components
TI-2024-24309 CVE-2024-36540 · GHSA-h9mr-jrr6-mjrf
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive…
Priority MEDIUM 49
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
TI-2026-18338 CVE-2026-22822 · GHSA-77v3-r3jw-j2v2
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
Priority MEDIUM 41
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
TI-2026-27206 CVE-2026-34984 · GHSA-r2pg-r6h7-crf3
External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
Priority LOW 31
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.