CVE-2026-26287
published 2026-10-06CVE-2026-26287: External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0…
PriorityP337high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.24%
15.5th percentile
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| external-secrets-operator | external-secrets-rhel9 | — | — |
| external-secrets | external-secrets | — | — |
| github.com | external-secrets_external-secrets | >= 0.10.0 < 1.3.2 | 1.3.2 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/external-secrets/external-secrets: external-secrets: Sensitive information disclosure via webhook generator label enforcement bypass
vendor_redhat·2026-10-06·CVSS 7.1
CVE-2026-26287 [HIGH] CWE-639 github.com/external-secrets/external-secrets: external-secrets: Sensitive information disclosure via webhook generator label enforcement bypass
github.com/external-secrets/external-secrets: external-secrets: Sensitive information disclosure via webhook generator label enforcement bypass
A flaw was found in external-secrets. An issue during webhook generator initialization incorrectly clears the label enforcement setting, bypassing provider-side validation. An authenticated user with permissions to create webhook generators can target arbitrary secrets lacking the required label and exfiltrate them to an external endpoint, resulting in unauthorized information disclosure.
Statement: Red Hat is aware of a vulnerability in External Secrets Operator where label enforcement for webhook generators can be bypassed. An authorized user who can create a webhook generator may retrieve and exfiltrate a Secret that is not labeled for webhook
GHSA
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
ghsa·2026-10-06
CVE-2026-26287 [HIGH] CWE-696 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
## Summary
A bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`.
## Impact
A user with the permission to create webhook generator can set the webhook generator to a victim' secret (which was not previously labelled for webhook's use), and exfiltrate it to a malicious URL.
## Mitigations
Until you upgrade, you can reduce risk by:
- disabli
No detection rules found.
No public exploits indexed.
https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93bahttps://github.com/external-secrets/external-secrets/pull/5901https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8
2026-10-06
Published