CVE-2026-26287High· 7.1▾ TwilightExternal Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization ord…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag (EnforceLabels) after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped (and the operation to succeed while it should have failed with secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook. Version 1.3.2 contains a patch.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/external-secrets/external-secrets >= 0.10.0, < 1.3.2Patched in:
github.com/external-secrets/external-secrets 1.3.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42876High· 8.1external-secrets-operator: External Secrets Operator: Privilege escalation via ExternalSecret resource creation (CVE-2026-42876)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
CVE-2026-105745Medium· 6.7Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-65219High· 7.4Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
CVE-2026-73535High· 8.8Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier
CVE-2026-110450High· 8.0Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.