External-Secrets

8 CVEs across 2 External-Secrets products. Browse External-Secrets vulnerabilities, severities, and proof-of-concept exploits.

External-Secrets products with known CVEs

ProductCVEs
External-Secrets7
External Secrets Operator4
External-Secrets CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-42876Medium4.92026-05-11External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who o…
CVE-2026-428752026-05-11External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced S…
CVE-2026-34984Medium6.52026-04-14External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below con…
CVE-2026-22822High8.82026-01-21External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2…
CVE-2025-621592025-10-10External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discover…
CVE-2025-551962025-08-13External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability wa…
CVE-2024-45041High8.32024-09-09External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-ext…
CVE-2024-36540Critical9.82024-07-24Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.