Read the docs
TI-2026-68477 Aliases CVE-2026-26287

External Secrets Operator webhook generator skips label enforcement

Priority LOW 31CWE-696Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

External Secrets Operator from 0.10.0 before 1.3.2 is affected. A bug in the webhook generator initialization order (CWE-696) clears the EnforceLabels flag after it is set, so the check for the external-secrets.io/type=webhook label is skipped. An attacker with low privileges over the network can exfiltrate secret values because the operation succeeds when it should fail.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Partial external-secrets (external-secrets): 1.3.2github.com/external-secrets/external-secrets (Go): 1.3.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
external-secretsexternal-secrets0.10.0 to before 1.3.21.3.2Patch availableCNA
—github.com/external-secrets/external-secrets (Go)0.10.0 to before 1.3.21.3.2Patch availableGHSA-q7hv-xx6h-q2x8
  • external-secrets Vendorexternal-secrets Affected 0.10.0 to before 1.3.2 Fixed in 1.3.2 Patch available CNA
  • github.com/external-secrets/external-secrets (Go) Vendor— Affected 0.10.0 to before 1.3.2 Fixed in 1.3.2 Patch available GHSA-q7hv-xx6h-q2x8

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:*——external-secrets
  • cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:* Versions — — ·external-secrets

Remediation

Update External Secrets Operator to version 1.3.2, which contains the patch, and the github.com/external-secrets/external-secrets Go package to 1.3.2. Red Hat lists External Secrets Operator for Red Hat OpenShift as affected without a fix and has no fix plan for it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA external-secrets (external-secrets) Fixed in 1.3.2
  • Fix · GHSA-q7hv-xx6h-q2x8 github.com/external-secrets/external-secrets (Go) Fixed in 1.3.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
External Secrets Operator for Red Hat OpenShiftAffectedNo fix yet

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-26287
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-07 CVSS score added · Red Hat

References

Other 5

  • TI-2024-30153 External Secrets Operator vulnerable to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2024-24309 Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive… CVSS 3.1CRITICAL 9.8
  • TI-2026-18338 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVSS 4.0CRITICAL 9.3
  • TI-2025-38481 External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval CVSS 4.0HIGH 8.7
  • TI-2026-31081 External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore CVSS 4.0MEDIUM 5.3
  • TI-2026-27206 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine CVSS 4.0HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences