External-secrets vulnerabilities
We track 6 vulnerabilities in External-secrets products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 6, 2026.
Latest External-secrets vulnerabilities
- 7.1 High severity
external-secrets: Incorrect Behavior Order
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared
- 8.8 High severity
external-secrets: Incorrect Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Dev
- 8.7 High severity
external-secrets: Improper Access Control
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through 0
- 7.1 High severity
external-secrets: Improper Access Control
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the
- 8.8 High severity
external-secrets: Incorrect Permission Assignment for Critical Resource
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get
- 9.8 Critical severity
external-secrets: Insecure Inherited Permissions
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.