---
id: CVE-2026-42876
title: >-
  external-secrets-operator: External Secrets Operator: Privilege escalation via
  ExternalSecret resource creation (CVE-2026-42876)
summary: >-
  A flaw was found in External Secrets Operator. A user with permissions to
  create ExternalSecret resources can trick the operator into creating a
  Kubernetes Secret that automatically contains a long-lived token for a
  specified service accou…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: vendor
cwe:
  - CWE-285
vendor: Red Hat
product: external-secrets
affected:
  - external-secrets < 2.4.1
published: '2026-05-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:00:33+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42876.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42876.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42876'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42876'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42876'
  - url: >-
      https://github.com/external-secrets/external-secrets/commit/4ddd240af7fe88725d9857b9a0c198073502e288
  - url: 'https://github.com/external-secrets/external-secrets/releases/tag/v2.4.1'
  - url: >-
      https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fq7h-9x26-6j22
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00215
epssPercentile: 0.11768
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-12T13:26:08.541848Z'
scores:
  vendor: 8.1
  cna: 4.9
ingestedAt: '2026-10-06T16:04:04.485Z'
---

## Overview

A flaw was found in External Secrets Operator. A user with permissions to create ExternalSecret resources can trick the operator into creating a Kubernetes Secret that automatically contains a long-lived token for a specified service account. This allows the user to impersonate any service account within the same namespace, bypassing direct permissions for token or secret creation. This vulnerability leads to privilege escalation.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42876.json)

**external-secrets-operator: External Secrets Operator: Privilege escalation via ExternalSecret resource creation**. Released 2026-05-11, updated 2026-10-14.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.