CVE-2026-42876

Description

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.

References

https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fq7h-9x26-6j22

https://github.com/external-secrets/external-secrets/releases/tag/v2.4.1

https://github.com/external-secrets/external-secrets/commit/4ddd240af7fe88725d9857b9a0c198073502e288

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29191

Details

Source: Mitre, NVD

Named Vulnerability: GO-2026-5377Named Vulnerability: GHSA-fq7h-9x26-6j22

Risk Information

CVSS v2

CVSS v3

EPSS