Executive brief
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets
Affected products
- Go github.com/external-secrets/external-secrets
Junglewise Threat Intelligence
CVE-2025-55196: GO-2025-3885 - External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets
CVE-2025-55196 · Severity: medium · CVSS 4 · Published 2025-08-18
Technologies: github.com/external-secrets/external-secrets (Go). Vendors: Go.
Related threats
- External Secrets Operator namespace isolation bypass in CAProvider ConfigMap
- External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
- External Secrets Operator authorization bypass in getSecretKey function
- GO-2024-3126 - External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets