Vulnerabilities

TI-2026-27206 CVE-2026-34984 · GHSA-r2pg-r6h7-crf3

External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

LOW 31

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00262 Published 2026-04-14 Partial fix · 2.3.0, 1.3.3-0.20260331202714-6800989bdc12 CWE-200

TI-2026-18338 CVE-2026-22822 · GHSA-77v3-r3jw-j2v2

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

MEDIUM 41

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.

CVSS 4.0CRITICAL 9.3 Local Low privileges No interaction EPSS 0.00192 Published 2026-01-21 Partial fix · 1.2.0 CWE-863

TI-2024-30153 CVE-2024-45041 · GHSA-qwgc-rr35-h4x9

External Secrets Operator vulnerable to privilege escalation

HIGH 71

External Secrets Operator is a Kubernetes operator that integrates external secret management systems.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00591 Published 2024-09-09 Fixed in 0.10.2 CWE-269

TI-2024-24309 CVE-2024-36540 · GHSA-h9mr-jrr6-mjrf

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive…

MEDIUM 49

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00421 Published 2024-07-24 No fix listed CWE-277

Vulnerabilities

Filters

External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

External Secrets Operator vulnerable to privilege escalation

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive…