GHSA-Q7HV-XX6H-Q2X8

Vulnerability from github – Published: 2026-10-06 15:29 – Updated: 2026-10-06 15:29
VLAI
Summary
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
Details

Summary

A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag (EnforceLabels) after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped (and the operation to succeed while it should have failed with secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook.

Impact

A user with the permission to create webhook generator can set the webhook generator to a victim' secret (which was not previously labelled for webhook's use), and exfiltrate it to a malicious URL.

Mitigations

Until you upgrade, you can reduce risk by: - disabling webhook generators if not needed (or denying generators.external-secrets.io/v1alpha1 Webhook via an admission policy); - restricting RBAC: limit who can create generators of kind Webhook; - enforcing an admission policy (OPA Gatekeeper / Kyverno) requiring referenced secrets to be labeled external-secrets.io/type=webhook; - restricting egress from external-secrets controller pods to an allowlist (kubernetes NetworkPolicy / service mesh egress policy).

References

  • PR #5901 (fix: webhook initialization order)
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/external-secrets/external-secrets"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26287"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-696"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T15:29:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nA bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label \u0027external-secrets.io/type: webhook\u0027. Update secret label to use it with webhook`.\n\n## Impact\nA user with the permission to create webhook generator can set the webhook generator to a victim\u0027 secret (which was not previously labelled for webhook\u0027s use), and exfiltrate it to a malicious URL.\n\n## Mitigations\nUntil you upgrade, you can reduce risk by:\n- disabling webhook generators if not needed (or denying `generators.external-secrets.io/v1alpha1` `Webhook` via an admission policy);\n- restricting RBAC: limit who can create generators of kind `Webhook`;\n- enforcing an admission policy (OPA Gatekeeper / Kyverno) requiring referenced secrets to be labeled `external-secrets.io/type=webhook`;\n- restricting egress from external-secrets controller pods to an allowlist (kubernetes `NetworkPolicy` / service mesh egress policy).\n\n## References\n- PR #5901 (fix: webhook initialization order)",
  "id": "GHSA-q7hv-xx6h-q2x8",
  "modified": "2026-10-06T15:29:25Z",
  "published": "2026-10-06T15:29:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/pull/5901"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/external-secrets/external-secrets"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.