Secret Abuse Vulnerability in External Secrets Operator

CVE-2024-45041

What is CVE-2024-45041?

A vulnerability exists in the External Secrets Operator, an essential Kubernetes operator designed to integrate external secret management systems. Specifically, the issue arises with the deployment named default-external-secrets-cert-controller, which is associated with a ClusterRole of the same name. This ClusterRole permits 'get/list' access to secrets resources and provides path/update capabilities via validatingwebhookconfigurations. The exploitation of this flaw enables unauthorized access to all secrets within the cluster, allowing malicious actors to capture and log sensitive information during secret updates, as well as to create webhooks that may deny essential Pod creation and update requests. This vulnerability has been resolved in version 0.10.2.

References