Cross-Namespace Secret Access Vulnerability in External Secrets Operator by External Secrets

CVE-2026-22822

What is CVE-2026-22822?

The External Secrets Operator has a vulnerability that allows unauthorized fetching of secrets across different namespaces due to the 'getSecretKey' template function. Introduced for the senhasegura DevOps Secrets Management provider, this function can bypass security measures in versions 0.20.2 up to 1.1.x. The function poses a risk as it retrieves secrets using the role binding of the external-secrets controller. The vulnerability was addressed in version 1.2.0, where 'getSecretKey' was completely removed to enhance security. Users are advised to implement policy engines like Kubernetes, Kyverno, Kubewarden, or OPA as a workaround to prevent its usage in ExternalSecret resources.

References