CVE-2026-22822
📋 TL;DR
The External Secrets Operator's getSecretKey template function allows cross-namespace secret retrieval, bypassing Kubernetes RBAC controls. This affects users of External Secrets Operator versions 0.20.2 through 1.1.x. Attackers with access to create ExternalSecret resources could potentially access secrets from unauthorized namespaces.
💻 Affected Systems
- External Secrets Operator
📦 What is this software?
External Secrets Operator by External Secrets
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all secrets managed by External Secrets Operator across all namespaces, leading to credential theft, data breaches, and lateral movement within the cluster.
Likely Case
Unauthorized access to secrets in other namespaces, potentially exposing sensitive credentials, API keys, or configuration data that should be namespace-isolated.
If Mitigated
Limited impact with proper network segmentation and namespace isolation, but still represents a privilege escalation vulnerability within the cluster.
🎯 Exploit Status
Exploitation requires Kubernetes API access and permissions to create ExternalSecret resources. The vulnerability is well-documented in the advisory with clear attack vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2
Restart Required: Yes
Instructions:
1. Backup current External Secrets Operator configuration. 2. Update to version 1.2.0 or later using your deployment method (Helm, kubectl, operator). 3. Verify the controller pods restart successfully. 4. Test secret retrieval functionality.
🔧 Temporary Workarounds
Policy Engine Restriction
allUse Kubernetes admission controllers like OPA Gatekeeper, Kyverno, or Kubewarden to block usage of getSecretKey template function in ExternalSecret resources.
🧯 If You Can't Patch
- Implement strict RBAC controls to limit who can create or modify ExternalSecret resources
- Deploy network policies to isolate External Secrets Operator components and limit their access to only necessary namespaces
🔍 How to Verify
Check if Vulnerable:
Check External Secrets Operator version: kubectl get deployment -n external-secrets external-secrets -o jsonpath='{.spec.template.spec.containers[0].image}'Check Version:
kubectl get deployment -n external-secrets external-secrets -o jsonpath='{.spec.template.spec.containers[0].image}' | grep -o 'v[0-9.]*'Verify Fix Applied:
Confirm version is 1.2.0 or later and check that getSecretKey function references are removed from ExternalSecret resources📡 Detection & Monitoring
Log Indicators:
- Audit logs showing ExternalSecret creation with getSecretKey function
- Controller logs showing cross-namespace secret retrieval
Network Indicators:
- Unusual API calls to external secret providers from unexpected namespaces
SIEM Query:
kubernetes.audit.objectRef.resource: externalsecrets AND kubernetes.audit.verb: create AND requestObject.spec.data[*].remoteRef.template: *getSecretKey*🔗 References
- https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb
- https://github.com/external-secrets/external-secrets/issues/5690
- https://github.com/external-secrets/external-secrets/pull/3895
- https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0
- https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2
