CVE-2026-22822: External Secrets Operator authorization bypass in getSecretKey function

CVE-2026-22822 · Severity: high · CVSS 8.8 · Published 2026-01-21

The External Secrets Operator, a tool used to synchronize sensitive information from third-party services into Kubernetes, contains a vulnerability that allows users to access secrets they should not be able to see. By using a specific template function, a user with limited access can bypass security boundaries to fetch secrets from different namespaces across the cluster. This could lead to the unauthorized exposure of sensitive credentials, potentially compromising the entire Kubernetes environment.

Technologies: github.com/external-secrets/external-secrets (Go). Vendors: Go, Red Hat.

Quick answers

Is CVE-2026-22822 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22822 being exploited in the wild.
How severe is CVE-2026-22822?
High severity, with a CVSS score of 8.8, published 21 January 2026.
Which products and versions are affected?
github.com/external-secrets/external-secrets (Go) SEMVER:introduced=0.20.2,fixed=1.2.0; Red Hat External Secrets Operator for Red Hat OpenShift 0.
Is there a fix for CVE-2026-22822?
Yes. github.com/external-secrets/external-secrets (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22822 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-22822?
Check whether you run github.com/external-secrets/external-secrets (Go) or Red Hat External Secrets Operator for Red Hat OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/external-secrets/external-secrets (Go): upgrade to 1.2.0 or later
    go get github.com/external-secrets/external-secrets@v1.2.0

Technical details

An authorization bypass vulnerability exists in the External Secrets Operator (ESO) due to the implementation of the `getSecretKey` template function. This function, originally introduced for the senhasegura Devops Secrets Management (DSM) provider, utilizes the high-privilege RoleBinding of the external-secrets controller rather than the user's own permissions. A local attacker with the ability to create or modify `ExternalSecret` resources can exploit this to fetch secrets from any namespace, bypassing ESO's intended security isolation mechanisms. The vulnerability was addressed in version 1.2.0 by completely removing the `getSecretKey` function. Users are advised to upgrade or implement policy engine rules (e.g., OPA, Kyverno) to block the usage of this specific function in resources.

Affected products

  • external-secrets External Secrets Operator >= 0.20.2, < 1.2.0
  • Red Hat external secrets operator for Red Hat OpenShift - Tech Preview 0

Identifiers

  • CVE-2026-22822
  • GHSA-77v3-r3jw-j2v2
  • GO-2026-4330

Timeline

  • 2026-01-21: disclosed: Initial advisory publication
  • 2026-01-21: advisory: GitHub Security Advisory GHSA-77v3-r3jw-j2v2 published
  • 2025-12-19: patched: Version 1.2.0 released removing the vulnerable function

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.