Unauthenticated POST Endpoint Vulnerability in Sealed Secrets by Bitnami
CVE-2026-59341

4.2MEDIUM

Key Information:

Vendor

Bitnami

Status
Sealed-secrets
Vendor
CVE Published:
15 September 2026

What is CVE-2026-59341?

A security issue exists in the Sealed Secrets controller due to its unauthenticated POST endpoints. By submitting a custom payload with Go template logic in the spec.template.data field, an attacker with internal network access can exploit the handler as a decryption oracle. This vulnerability allows the extraction of sensitive secrets by leveraging the mapping of HTTP response codes to template execution outcomes. Specifically, successful template execution is indicated by an HTTP 200 status, while execution failures return an HTTP 409 status. This differential response can be exploited to iteratively reveal secrets through crafted requests, posing a serious security risk within Kubernetes environments.

Affected Version(s)

sealed-secrets 0 <= 0.38.4

sealed-secrets 0.40.0

References

https://github.com/bitnami/sealed-secrets/security/adviso...
https://github.com/bitnami/sealed-secrets

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.