Executive brief
External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets
Affected products
- Go github.com/external-secrets/external-secrets
Junglewise Threat Intelligence
CVE-2024-45041: GO-2024-3126 - External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets
CVE-2024-45041 · Severity: low · CVSS 3.1 · Published 2024-09-13
Vendors: Go.
Related threats
- External Secrets Operator namespace isolation bypass in CAProvider ConfigMap
- External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
- External Secrets Operator authorization bypass in getSecretKey function
- GO-2025-3885 - External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets