Is CVE-2026-26287 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26287 being exploited in the wild.

How severe is CVE-2026-26287?

High severity, with a CVSS score of 7.1, published 6 October 2026.

Which products and versions are affected?

External-Secrets External Secrets Operator 0.10.0 to 1.3.1; github.com/external-secrets/external-secrets (Go) >= 0.10.0, < 1.3.2, SEMVER:introduced=0.10.0,fixed=1.3.2.

How is CVE-2026-26287 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26287?

Check whether you run External-Secrets External Secrets Operator or github.com/external-secrets/external-secrets (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26287: External Secrets Operator label enforcement bypass in webhook generator

Q: Is there a fix for CVE-2026-26287?

Yes. github.com/external-secrets/external-secrets (Go): upgrade to 1.3.2 or later. Until then: Disable webhook generators if not needed via admission policy; restrict RBAC to limit who can create Webhook generators; enforce an admission policy requiring referenced secrets to be labeled external-secrets.io/type=webhook; restrict egress from external-secrets controller pods using NetworkPolicy or service mesh policies. [{"kind":"disclosed","at":"2026-10-06"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-26287 · Severity: high · CVSS 7.1 · Published 2026-10-06

External Secrets Operator is a Kubernetes tool that securely manages secrets from external systems. A bug in the webhook generator allows an attacker with permissions to create webhook generators to bypass security labels and steal secrets from other Kubernetes resources by redirecting them to a malicious URL.

Technologies: github.com/external-secrets/external-secrets (Go). Vendors: Go.

Quick answers

Is CVE-2026-26287 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26287 being exploited in the wild.
How severe is CVE-2026-26287?: High severity, with a CVSS score of 7.1, published 6 October 2026.
Which products and versions are affected?: External-Secrets External Secrets Operator 0.10.0 to 1.3.1; github.com/external-secrets/external-secrets (Go) >= 0.10.0, < 1.3.2, SEMVER:introduced=0.10.0,fixed=1.3.2.
Is there a fix for CVE-2026-26287?: Yes. github.com/external-secrets/external-secrets (Go): upgrade to 1.3.2 or later. Until then: Disable webhook generators if not needed via admission policy; restrict RBAC to limit who can create Webhook generators; enforce an admission policy requiring referenced secrets to be labeled external-secrets.io/type=webhook; restrict egress from external-secrets controller pods using NetworkPolicy or service mesh policies.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-06"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26287 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26287?: Check whether you run External-Secrets External Secrets Operator or github.com/external-secrets/external-secrets (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/external-secrets/external-secrets (Go): upgrade to 1.3.2 or later
```
go get github.com/external-secrets/external-secrets@v1.3.2
```

Disable webhook generators if not needed via admission policy; restrict RBAC to limit who can create Webhook generators; enforce an admission policy requiring referenced secrets to be labeled external-secrets.io/type=webhook; restrict egress from external-secrets controller pods using NetworkPolicy or service mesh policies.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-06"}]

Technical details

The webhook generator initialization incorrectly clears the EnforceLabels flag after it is set, causing the provider-side validation for the external-secrets.io/type=webhook label to be skipped. An attacker with webhook generator creation permissions can exploit this to access and exfiltrate secrets that lack the required label. The vulnerability requires attacker privileges to create webhook generators and network-level access to a malicious endpoint.

Affected products

external-secrets External Secrets Operator 0.10.0 to 1.3.1

Identifiers

CVE-2026-26287
GHSA-q7hv-xx6h-q2x8
GO-2026-6667

References

https://api.github.com/users/1seal

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.