TI-2026-18253 Aliases CVE-2026-22728 GHSA-465p-v42x-3fmj

sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

LOW 23CWE-284Published 2026-02-26 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original "strict" or "namespace-wide" constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00408 35th percentileScored 2026-11-07

Fix Fixed sealed-secrets (Bitnami): <0.36.0github.com/bitnami-labs/sealed-secrets (Go): 0.36.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bitnami	sealed-secrets	0.35.0 to before <0.36.0	<0.36.0	Patch available	CNA
—	github.com/bitnami-labs/sealed-secrets (Go)	before 0.36.0	0.36.0	Patch available	GHSA-465p-v42x-3fmj

sealed-secrets VendorBitnami Affected 0.35.0 to before <0.36.0 Fixed in <0.36.0 Patch available CNA
github.com/bitnami-labs/sealed-secrets (Go) Vendor— Affected before 0.36.0 Fixed in 0.36.0 Patch available GHSA-465p-v42x-3fmj

Remediation

Fix · CNA sealed-secrets (Bitnami) Fixed in <0.36.0
Fix · GHSA-465p-v42x-3fmj github.com/bitnami-labs/sealed-secrets (Go) Fixed in 0.36.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-22728
2026-10-03 Alias added: GHSA-465p-v42x-3fmj

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-22728

Other 4

TI-2026-42460 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints CVSS 3.1MEDIUM 4.2
TI-2026-35298 Hard-coded credentials in bitnami/cassandra CVSS 3.1CRITICAL 9.8
TI-2021-05023 Hard-coded credentials in Bitnami Containers CVSS 3.1HIGH 7.3
TI-2026-35299 Hard-coded credentials in bitnami/mariadb-galera CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences