# CVE-2026-22822: External Secrets Operator authorization bypass in getSecretKey function

Source: https://junglewise.ai/threats/cve-2026-22822-external-secrets-operator-authorization-bypass-in-getsecretkey  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-21. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-22822 · Severity: high · CVSS 8.8 · Published 2026-01-21

The External Secrets Operator, a tool used to synchronize sensitive information from third-party services into Kubernetes, contains a vulnerability that allows users to access secrets they should not be able to see. By using a specific template function, a user with limited access can bypass security boundaries to fetch secrets from different namespaces across the cluster. This could lead to the unauthorized exposure of sensitive credentials, potentially compromising the entire Kubernetes environment.

Technologies: [github.com/external-secrets/external-secrets (Go)](https://junglewise.ai/threats/technologies/github-com-external-secrets-external-secrets). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-22822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22822 being exploited in the wild.

**How severe is CVE-2026-22822?** High severity, with a CVSS score of 8.8, published 21 January 2026.

**Which products and versions are affected?** github.com/external-secrets/external-secrets (Go) SEMVER:introduced=0.20.2,fixed=1.2.0; Red Hat External Secrets Operator for Red Hat OpenShift 0.

**Is there a fix for CVE-2026-22822?** Yes. github.com/external-secrets/external-secrets (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22822 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-22822?** Check whether you run github.com/external-secrets/external-secrets (Go) or Red Hat External Secrets Operator for Red Hat OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/external-secrets/external-secrets (Go): upgrade to 1.2.0 or later

  ```sh
  go get github.com/external-secrets/external-secrets@v1.2.0
  ```


## Technical details

An authorization bypass vulnerability exists in the External Secrets Operator (ESO) due to the implementation of the `getSecretKey` template function. This function, originally introduced for the senhasegura Devops Secrets Management (DSM) provider, utilizes the high-privilege RoleBinding of the external-secrets controller rather than the user's own permissions. A local attacker with the ability to create or modify `ExternalSecret` resources can exploit this to fetch secrets from any namespace, bypassing ESO's intended security isolation mechanisms. The vulnerability was addressed in version 1.2.0 by completely removing the `getSecretKey` function. Users are advised to upgrade or implement policy engine rules (e.g., OPA, Kyverno) to block the usage of this specific function in resources.

## Affected products

- external-secrets External Secrets Operator >= 0.20.2, < 1.2.0
- Red Hat external secrets operator for Red Hat OpenShift - Tech Preview 0

## Identifiers

- CVE-2026-22822
- GHSA-77v3-r3jw-j2v2
- GO-2026-4330

## Timeline

- 2026-01-21: disclosed: Initial advisory publication
- 2026-01-21: advisory: GitHub Security Advisory GHSA-77v3-r3jw-j2v2 published
- 2025-12-19: patched: Version 1.2.0 released removing the vulnerable function

## References

- [https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb](https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb)
- [https://github.com/external-secrets/external-secrets/issues/5690](https://github.com/external-secrets/external-secrets/issues/5690)
- [https://github.com/external-secrets/external-secrets/pull/3895](https://github.com/external-secrets/external-secrets/pull/3895)
- [https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0)
- [https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2](https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2)
- [https://access.redhat.com/security/cve/CVE-2026-22822](https://access.redhat.com/security/cve/CVE-2026-22822)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2431873](https://bugzilla.redhat.com/show_bug.cgi?id=2431873)

## Related threats

- [External Secrets Operator label enforcement bypass in webhook generator](https://junglewise.ai/threats/cve-2026-26287-external-secrets-operator-label-enforcement-bypass-in-webhook)
- [External Secrets Operator namespace isolation bypass in CAProvider ConfigMap](https://junglewise.ai/threats/cve-2026-42875-external-secrets-operator-namespace-isolation-bypass-in)
- [External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine](https://junglewise.ai/threats/cve-2026-34984-external-secrets-operator-has-dns-based-secret-exfiltration-via)
- [External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access](https://junglewise.ai/threats/cve-2025-55196-external-secrets-operator-s-missing-namespace-restriction-allows)
- [GO-2024-3126 - External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets](https://junglewise.ai/threats/cve-2024-45041-external-secrets-operator-vulnerable-to-privilege-escalation)