CVE-2026-42875: medium-severity vulnerability in external-secrets
External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. This vulnerability is fixed in 2.4.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
external-secrets · external-secretsRelated CVEs — external-secrets
In the same product, most dangerous first.
CVE-2024-45041HIGHExternal Secrets Operator vulnerable to privilege escalationEPSS 0.6%CVE-2025-55196HIGHExternal Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret AccessEPSS 0.4%CVE-2025-62159HIGHExternal Secrets Operator's BeyondTrust Provider has Insecure Secret RetrievalEPSS 0.3%CVE-2026-34984HIGHExternal Secrets Operator has DNS exfiltration via getHostByName in its v2 template engineEPSS 0.3%CVE-2026-26287HIGHExternal Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationEPSS 0.2%CVE-2026-42876MEDIUMExternal Secrets Operator: Privilege escalation with secret overwritingEPSS 0.2%