Kubernetes Secret Vulnerability in External Secrets Operator by External Secrets

CVE-2026-42876

What is CVE-2026-42876?

The External Secrets Operator, which integrates third-party services with Kubernetes by creating Secrets, has a significant vulnerability that allows users with permission only to create ExternalSecret resources to generate Secrets that automatically populate with long-lived service account tokens. This manipulation enables unauthorized impersonation of service accounts within the namespace, bypassing the need for direct permissions on TokenRequest or Secrets of that type. This issue was addressed in version 2.4.1, highlighting the importance of keeping cloud-native tooling updated to avoid security risks.

References