Github.Com External-Secrets External-Secrets vulnerabilities

CVE-2024-45041 [HIGH] CWE-269 External Secrets Operator vulnerable to privilege escalation External Secrets Operator vulnerable to privilege escalation ### Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49). It also

CVE-2026-22822 [CRITICAL] CWE-863 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function ### Summary The `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanism

CVE-2025-55196 [HIGH] CWE-284 External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access ## Summary A vulnerability was discovered in the External Secrets Operator where the `List()` calls for Kubernetes Secret and SecretStore resources performed by the `PushSecret` controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list

CVE-2026-34984 [HIGH] CWE-200 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine ## Summary The v2 template engine in `runtime/template/v2/template.go` imports Sprig’s `TxtFuncMap()` and removes `env` and `expandenv`, but leaves `getHostByName` available to user-controlled templates. Because ESO executes templates

CVE-2026-42875 [LOW] CWE-285 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore ### Impact Namespaced SecretStore resources that used CAProvider with type `ConfigMap` could resolve CA material from another namespace when `caProvider.namespace` was set. This bypassed the namespace boundary enforced for SecretStore-backed references