external-secrets vulnerabilities
CVEs whose affected-version data names the external-secrets package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-26287High· 7.1External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization ord…
▾ Twilightexternal-secrets · external-secretsEPSS 0.24%via NVD
CVE-2026-42876High· 8.1⚖ disputedexternal-secrets-operator: External Secrets Operator: Privilege escalation via ExternalSecret resource creation (CVE-2026-42876)
A flaw was found in External Secrets Operator. A user with permissions to create ExternalSecret resources can trick the operator into creating a Kubernetes Secret that automatically contains a long-lived token for a specified service accou…
▾ TwilightRed Hat · external-secretsEPSS 0.21%via CSAF