CVE-2026-22822
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in External Secrets Operator (versions 0.20.2 to 1.2.0) allows bypassing security mechanisms via the `getSecretKey` template function, which can fetch secrets across namespaces using the controller's roleBinding. This function was completely removed in version 1.2.0.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to secrets in different namespaces, leading to data leakage and violation of Kubernetes security policies.
Recommendation
Immediately upgrade External Secrets Operator to version 1.2.0 or later. As a workaround, use a policy engine (e.g., Kyverno, OPA) to block the use of `getSecretKey` in any ExternalSecret resource.
Other vulnerabilities in External Secrets Operator
See all- CVE-2026-26287High
External Secrets Operator versions from 0.10.0 to 1.3.1 contain a bug in the webhook generator initialization order that clears the EnforceLabels flag after it is set. This skips the label check for external-secrets.io/type=webhook, allowing an operation that should fail. Version 1.3.2 contains a patch.
- CVE-2025-62159High
In External Secrets Operator versions 0.10.1 through 0.19.2, the BeyondTrust provider retrieved Kubernetes secrets directly without validating the namespace context or the type of secret store. This allowed unauthorized cross-namespace secret access, violating security boundaries and potentially exposing sensitive credentials.
Original NVD description (English source)
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS