Aller au contenu
en Se connecter
4.9 Moyenne

CVE-2026-42876 External Secrets Operator reads information from a third-party service and automatically injects the values as…

Description

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
external-secrets 2.4 premières → < 2.4.1 2.4.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de external-secrets

Les 9 CVE de external-secrets →
CVE-2026-26287 External Secrets Operator reads information from a third-party service and automatically injects the values as… 7.1 Élevée CVE-2026-42875 External Secrets Operator reads information from a third-party service and automatically injects the values as… 5.3 Moyenne CVE-2026-34984 External Secrets Operator reads information from a third-party service and automatically injects the values as… 7.1 Élevée CVE-2026-22822 External Secrets Operator reads information from a third-party service and automatically injects the values as… 9.3 Critique
Suivre cette CVE