Information disclosure in External-secrets
CVE-2026-34984
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template en…
Vulnerability class: Information Disclosure
EPSS: 0.000 (12.1th percentile) — read the EPSS interpretation.
Affected products
- External-secrets — versions < 2.3.0
Weakness classification (CWE)
References
- https://github.com/external-secrets/external-secrets/security/advisories/GHSA-r2pg-r6h7-crf3 (x_refsource_CONFIRM)
- https://github.com/external-secrets/external-secrets/commit/6800989bdc12782ca2605d3b8bf7f2876a16551a (x_refsource_MISC)
- https://github.com/external-secrets/external-secrets/releases/tag/v2.3.0 (x_refsource_MISC)