CVE-2026-22822

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb	Patch
https://github.com/external-secrets/external-secrets/issues/5690	Issue Tracking
https://github.com/external-secrets/external-secrets/pull/3895	Issue Tracking
https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0	Product Release Notes
https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-21 22:15

Updated : 2026-02-18 15:29

NVD link : CVE-2026-22822

Mitre link : CVE-2026-22822

CVE.ORG link : CVE-2026-22822

JSON object : View

Products Affected

external-secrets

external_secrets_operator

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-22822", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-21T22:15:49.380", "references": [{"url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/external-secrets/external-secrets/issues/5690", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/external-secrets/external-secrets/pull/3895", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}, {"lang": "es", "value": "External Secrets Operator lee informaci\u00f3n de un servicio de terceros e inyecta autom\u00e1ticamente los valores como Secrets de Kubernetes. A partir de la versi\u00f3n 0.20.2 y antes de la versi\u00f3n 1.2.0, la funci\u00f3n de plantilla 'getSecretKey', aunque introducida para el proveedor senhasegura Devops Secrets Management (DSM), tiene la capacidad de obtener secretos entre espacios de nombres con el roleBinding del controlador external-secrets, eludiendo nuestros mecanismos de seguridad. Esta funci\u00f3n fue completamente eliminada en la versi\u00f3n 1.2.0, ya que todo lo que se hac\u00eda con esa funci\u00f3n de plantilla se puede hacer de una manera diferente respetando las salvaguardas de External Secrets Operator. Como soluci\u00f3n alternativa, utilice un motor de pol\u00edticas como Kubernetes, Kyverno, Kubewarden u OPA para evitar el uso de 'getSecretKey' en cualquier recurso ExternalSecret."}], "lastModified": "2026-02-18T15:29:01.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9E0E951-2317-45FB-A1AD-7426EFBBA6E3", "versionEndExcluding": "1.2.0", "versionStartIncluding": "0.20.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}