Read the docs
TI-2025-34872 Aliases CVE-2025-55196GHSA-fcxq-v2r3-cc8h

Improper access control in external-secrets

Priority LOW 31CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed external-secrets (external-secrets): 0.19.2github.com/external-secrets/external-secrets (Go): 0.19.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
external-secretsexternal-secrets0.15.0 to before 0.19.20.19.2Patch availableCNA
—github.com/external-secrets/external-secrets (Go)0.15.0 to before 0.19.20.19.2Patch availableGHSA-fcxq-v2r3-cc8h
  • external-secrets Vendorexternal-secrets Affected 0.15.0 to before 0.19.2 Fixed in 0.19.2 Patch available CNA
  • github.com/external-secrets/external-secrets (Go) Vendor— Affected 0.15.0 to before 0.19.2 Fixed in 0.19.2 Patch available GHSA-fcxq-v2r3-cc8h

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:*——external-secrets
  • cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:* Versions — — ·external-secrets

Remediation

  • Fix · CNA external-secrets (external-secrets) Fixed in 0.19.2
  • Fix · GHSA-fcxq-v2r3-cc8h github.com/external-secrets/external-secrets (Go) Fixed in 0.19.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55196
  2. 2026-10-03 Alias added: GHSA-fcxq-v2r3-cc8h

References

Advisory 1

Other 6

  • TI-2024-30153 External Secrets Operator vulnerable to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2024-24309 Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive… CVSS 3.1CRITICAL 9.8
  • TI-2026-18338 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVSS 4.0CRITICAL 9.3
  • TI-2025-38481 External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval CVSS 4.0HIGH 8.7
  • TI-2026-31081 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore CVSS 4.0MEDIUM 5.3
  • TI-2026-68477 External Secrets Operator webhook generator skips label enforcement CVSS 3.1HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences