External Secrets Operator vulnerabilities

External Secrets Operator versions from 0.10.0 to 1.3.1 contain a bug in the webhook generator initialization order that clears the EnforceLabels flag after it is set. This skips the label check for external-secrets.io/type=webhook, allowing an operation that should fail. Version 1.3.2 contains a patch.

A vulnerability in External Secrets Operator (versions 0.20.2 to 1.2.0) allows bypassing security mechanisms via the `getSecretKey` template function, which can fetch secrets across namespaces using the controller's roleBinding. This function was completely removed in version 1.2.0.

In External Secrets Operator versions 0.10.1 through 0.19.2, the BeyondTrust provider retrieved Kubernetes secrets directly without validating the namespace context or the type of secret store. This allowed unauthorized cross-namespace secret access, violating security boundaries and potentially exposing sensitive credentials.