CVE-2026-26287
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
External Secrets Operator versions from 0.10.0 to 1.3.1 contain a bug in the webhook generator initialization order that clears the EnforceLabels flag after it is set. This skips the label check for external-secrets.io/type=webhook, allowing an operation that should fail. Version 1.3.2 contains a patch.
Risk Assessment
The risk involves potential use of secrets without the required label, possibly leading to unauthorized data access.
Recommendation
Upgrade External Secrets Operator to version 1.3.2 or later.
Other vulnerabilities in External Secrets Operator
See all- CVE-2026-22822High
A vulnerability in External Secrets Operator (versions 0.20.2 to 1.2.0) allows bypassing security mechanisms via the `getSecretKey` template function, which can fetch secrets across namespaces using the controller's roleBinding. This function was completely removed in version 1.2.0.
- CVE-2025-62159High
In External Secrets Operator versions 0.10.1 through 0.19.2, the BeyondTrust provider retrieved Kubernetes secrets directly without validating the namespace context or the type of secret store. This allowed unauthorized cross-namespace secret access, violating security boundaries and potentially exposing sensitive credentials.
Original NVD description (English source)
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS