Vulnpedia
← Search CVEs

CVE-2026-26287

HIGH 7.1

Published 2026-10-06 · Last modified 2026-10-06

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.

ELEVATED IMPACT

Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 16th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.1CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors External Secrets

Products External Secrets

Weakness (CWE)

  • CWE-696: : Incorrect Behavior Order

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/external-secrets/external-secrets Go

    pkg:golang/github.com/external-secrets/external-secrets

    SEMVER range
    • Introduced version (included): 0.10.0
    • Fixed boundary (excluded): 1.3.2
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q7hv-xx6h-q2x8/GHSA-q7hv-xx6h-q2x8.json"
  }
}
    GitHub Advisory Database · GHSA-q7hv-xx6h-q2x8 · Updated 2026-10-20T00:55:45.081616683Z
  • github.com/external-secrets/external-secrets Go

    pkg:golang/github.com/external-secrets/external-secrets

    SEMVER range
    • Introduced version (included): 0.10.0
    • Fixed boundary (excluded): 1.3.2
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6667.json"
  }
}
    Go Vulnerability Database · GO-2026-6667 · Updated 2026-10-20T00:45:10.097500666Z

Vendor product assessments

  • external-secrets-operator/external-secrets-rhel9 as a component of External Secrets Operator for Red Hat OpenShift · known affected

    Vendor assessment for this product only.

    pkg:oci/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788?repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9

    • workaround: Until an update is available, disable webhook generators when they are not required. Restrict permission to create Webhook generator resources, enforce the external-secrets.io/type=webhook label with an admission policy, and restrict egress from External Secrets Operator controller pods to approved destinations. Upgrade to a Red Hat product update containing External Secrets Operator 1.3.2 or later when available.
    • none available: Affected
    Red Hat · CVE-2026-26287 · Updated 2026-10-07T11:08:00+00:00

All CVSS metrics

  • HIGH 7.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
  • HIGH 7.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS