Cross-Namespace Secret Access Vulnerability in External Secrets Operator by External Secrets
CVE-2026-22822

9.3CRITICAL

Key Information:

Vendor: External-secrets
Status: External-secrets
Vendor: CVE Published:; 21 January 2026

🔔 Create External-secrets Vulnerability Alert

What is CVE-2026-22822?

The External Secrets Operator has a vulnerability that allows unauthorized fetching of secrets across different namespaces due to the 'getSecretKey' template function. Introduced for the senhasegura DevOps Secrets Management provider, this function can bypass security measures in versions 0.20.2 up to 1.1.x. The function poses a risk as it retrieves secrets using the role binding of the external-secrets controller. The vulnerability was addressed in version 1.2.0, where 'getSecretKey' was completely removed to enhance security. Users are advised to implement policy engines like Kubernetes, Kyverno, Kubewarden, or OPA as a workaround to prevent its usage in ExternalSecret resources.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch