Read the docs
TI-2026-31081 Aliases CVE-2026-42875GHSA-wv26-88m5-6h59

External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Priority LOW 32CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. This vulnerability is fixed in 2.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix Fixed external-secrets (external-secrets): 2.4.0github.com/external-secrets/external-secrets (Go): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
external-secretsexternal-secretsbefore 2.4.02.4.0Patch availableCNA
—github.com/external-secrets/external-secrets (Go)before 2.4.02.4.0Patch availableGHSA-wv26-88m5-6h59
  • external-secrets Vendorexternal-secrets Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
  • github.com/external-secrets/external-secrets (Go) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-wv26-88m5-6h59

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:*——external-secrets
  • cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:* Versions — — ·external-secrets

Remediation

  • Fix · CNA external-secrets (external-secrets) Fixed in 2.4.0
  • Fix · GHSA-wv26-88m5-6h59 github.com/external-secrets/external-secrets (Go) Fixed in 2.4.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42875
  2. 2026-10-03 Alias added: GHSA-wv26-88m5-6h59

References

Advisory 1

Other 2

  • TI-2024-30153 External Secrets Operator vulnerable to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2024-24309 Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive… CVSS 3.1CRITICAL 9.8
  • TI-2026-18338 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVSS 4.0CRITICAL 9.3
  • TI-2025-38481 External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval CVSS 4.0HIGH 8.7
  • TI-2026-68477 External Secrets Operator webhook generator skips label enforcement CVSS 3.1HIGH 7.1
  • TI-2026-27206 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine CVSS 4.0HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences