Webhooks Vulnerability in External Secrets Operator for Kubernetes by External Secrets
CVE-2026-26287

7.1HIGH

Key Information:

Vendor

External-secrets

Status
External-secrets
Vendor
CVE Published:
6 October 2026

What is CVE-2026-26287?

The External Secrets Operator for Kubernetes has a vulnerability that affects versions 0.10.0 up to 1.3.1. A flaw in the webhook generator’s initialization process leads to the incorrect clearing of the label enforcement flag, allowing operations to proceed that should otherwise fail when the required label 'external-secrets.io/type: webhook' is missing. Users are recommended to upgrade to version 1.3.2, which includes a fix for this issue.

Affected Version(s)

external-secrets >= 0.10.0, < 1.3.2

References

https://github.com/external-secrets/external-secrets/secu...
x_refsource_CONFIRM
https://github.com/external-secrets/external-secrets/pull...
x_refsource_MISC
https://github.com/external-secrets/external-secrets/comm...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.