External Secrets Operator vulnerabilities
3 known vulnerabilities in External Secrets Operator from External-secrets. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
external-secrets: Incorrect Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Dev
- 8.8 High severity
external-secrets: Incorrect Permission Assignment for Critical Resource
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get
- 9.8 Critical severity
external-secrets: Insecure Inherited Permissions
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.