CVE-2026-34984
published 2026-04-14CVE-2026-34984: External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.26%
17.7th percentile
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap() but leaves the getHostByName function accessible to user-controlled templates. Since ESO executes templates within the controller process, an attacker who can create or update templated ExternalSecret resources can invoke controller-side DNS lookups using secret-derived values. This creates a DNS exfiltration primitive, allowing fetched secret material to be leaked via DNS queries without requiring direct outbound network access from the attacker's workload. The impact is a confidentiality issue, particularly in environments where untrusted or lower-trust users can author templated ExternalSecret resources and the controller has DNS resolution capability. This issue has been fixed in version 2.3.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| external-secrets | external-secrets | < 2.3.0 | 2.3.0 |
| external-secrets | external_secrets_operator | < 2.3.0 | 2.3.0 |
| github.com | external-secrets_external-secrets | >= 0 < 1.3.3-0.20260331202714-6800989bdc12 | 1.3.3-0.20260331202714-6800989bdc12 |
| github.com | external-secrets_external-secrets | 2.0.0 – 2.2.0 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
ghsa·2026-04-13
CVE-2026-34984 [HIGH] CWE-200 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
## Summary
The v2 template engine in `runtime/template/v2/template.go` imports Sprig’s `TxtFuncMap()` and removes `env` and `expandenv`, but leaves `getHostByName` available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secret-derived values, creating a DNS exfiltration primitive.
### Impact
This is a confidentiality issue. In environments where untrusted or lower-trust users can author templated ExternalSecret resources and the controller can perform DNS resolution, fetched secret material can be exfiltrated t
Red Hat
External Secrets Operator: github.com/external-secrets/external-secrets: External Secrets Operator: Information disclosure via DNS exfiltration in v2 template engine
vendor_redhat·2026-04-14·CVSS 7.1
CVE-2026-34984 [HIGH] CWE-94 External Secrets Operator: github.com/external-secrets/external-secrets: External Secrets Operator: Information disclosure via DNS exfiltration in v2 template engine
External Secrets Operator: github.com/external-secrets/external-secrets: External Secrets Operator: Information disclosure via DNS exfiltration in v2 template engine
A flaw was found in External Secrets Operator. An attacker with the ability to create or update templated ExternalSecret resources can exploit a vulnerability in the v2 template engine. This flaw allows the attacker to use the getHostByName function to perform controller-side DNS lookups, leading to the exfiltration of sensitive secret material through DNS queries. This results in a confidentiality issue, as secret data can be leaked without requiring direct outbound network access from the attacker's workload.
Statement: An attacker with permissions to create or update templated ExternalSecret resources in External Secrets
No detection rules found.
No public exploits indexed.
2026-04-14
Published