Junglewise Threat Intelligence

CVE-2026-22822: External Secrets Operator authorization bypass in getSecretKey function

CVE-2026-22822 · Severity: high · CVSS 8.8 · Published 2026-01-21

Technologies: github.com/external-secrets/external-secrets (Go), External-Secrets External Secrets Operator. Vendors: Go, Red Hat.

Executive brief

The External Secrets Operator, a tool used to synchronize sensitive information from third-party services into Kubernetes, contains a vulnerability that allows users to access secrets they should not be able to see. By using a specific template function, a user with limited access can bypass security boundaries to fetch secrets from different namespaces across the cluster. This could lead to the unauthorized exposure of sensitive credentials, potentially compromising the entire Kubernetes environment.

Technical details

An authorization bypass vulnerability exists in the External Secrets Operator (ESO) due to the implementation of the `getSecretKey` template function. This function, originally introduced for the senhasegura Devops Secrets Management (DSM) provider, utilizes the high-privilege RoleBinding of the external-secrets controller rather than the user's own permissions. A local attacker with the ability to create or modify `ExternalSecret` resources can exploit this to fetch secrets from any namespace, bypassing ESO's intended security isolation mechanisms. The vulnerability was addressed in version 1.2.0 by completely removing the `getSecretKey` function. Users are advised to upgrade or implement policy engine rules (e.g., OPA, Kyverno) to block the usage of this specific function in resources.

Affected products

  • external-secrets External Secrets Operator >= 0.20.2, < 1.2.0
  • Red Hat external secrets operator for Red Hat OpenShift - Tech Preview 0

Timeline

  • 2026-01-21: disclosed: Initial advisory publication
  • 2026-01-21: advisory: GitHub Security Advisory GHSA-77v3-r3jw-j2v2 published
  • 2025-12-19: patched: Version 1.2.0 released removing the vulnerable function

References

Related threats