Executive brief
Sealed Secrets is a Kubernetes controller that encrypts sensitive configuration data. A vulnerability in its unauthenticated POST endpoints allows attackers with internal cluster access to extract encrypted secrets through a side-channel attack. By submitting specially crafted requests with template logic, an attacker can observe HTTP response codes to determine the exact contents of any sealed secret character-by-character, completely bypassing encryption protection.
Technical details
The vulnerability combines two weaknesses: (1) missing AEAD label binding for the spec.template.data field allows an attacker to reuse valid encrypted metadata while injecting arbitrary Go template logic, and (2) template execution errors directly leak to HTTP response codes (200 for success, 409 for failure). An attacker can exploit these via conditional template expressions (e.g., {{ if eq (substr 0 1 .password) "S" }}ok{{ else }}{{ fail "x" }}{{ end }}) submitted to the /v1/verify or /v1/rotate endpoints. Each request reveals one character-equality bit, enabling full plaintext recovery over successive queries. Attack requires network access to the controller's internal service port (:8080), which is accessible to any pod in the Kubernetes cluster or via kubectl port-forward; no authentication is required.
Affected products
- Bitnami Sealed Secrets <UNKNOWN>
Timeline
- 2026-09-15: disclosed