CVE-2026-42876: fallo de gravedad media en external-secrets
External Secrets Operator: Privilege escalation with secret overwriting
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear external-secrets+ Monitorear github.com/external-secrets/external-secrets/apis
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.9epss 0.2%
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
external-secrets · external-secretsCVEs relacionadas — external-secrets
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-45041HIGHExternal Secrets Operator vulnerable to privilege escalationEPSS 0.6%CVE-2025-55196HIGHExternal Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret AccessEPSS 0.4%CVE-2025-62159HIGHExternal Secrets Operator's BeyondTrust Provider has Insecure Secret RetrievalEPSS 0.3%CVE-2026-34984HIGHExternal Secrets Operator has DNS exfiltration via getHostByName in its v2 template engineEPSS 0.3%CVE-2026-26287HIGHExternal Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationEPSS 0.2%CVE-2026-42875MEDIUMExternal Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreEPSS 0.2%