{"schema":"vulnpedia.research/1","cve":"CVE-2026-26287","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8","tags":["x_refsource_CONFIRM","WEB","ADVISORY","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"},{"source":"nvd","sourceId":"CVE-2026-26287","modified":"2026-10-06T20:03:40.690","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"},{"source":"go","sourceId":"GO-2026-6667","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"},{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"}]},{"url":"https://github.com/external-secrets/external-secrets/pull/5901","tags":["x_refsource_MISC","WEB","FIX","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","url":"https://github.com/external-secrets/external-secrets/pull/5901"},{"source":"nvd","sourceId":"CVE-2026-26287","modified":"2026-10-06T20:03:40.690","url":"https://github.com/external-secrets/external-secrets/pull/5901"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://github.com/external-secrets/external-secrets/pull/5901"},{"source":"go","sourceId":"GO-2026-6667","url":"https://github.com/external-secrets/external-secrets/pull/5901"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://github.com/external-secrets/external-secrets/pull/5901"},{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://github.com/external-secrets/external-secrets/pull/5901"}]},{"url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba","tags":["x_refsource_MISC","WEB","FIX","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"},{"source":"nvd","sourceId":"CVE-2026-26287","modified":"2026-10-06T20:03:40.690","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"},{"source":"go","sourceId":"GO-2026-6667","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"},{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"}]},{"url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T15:31:56.088Z","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"},{"source":"nvd","sourceId":"CVE-2026-26287","modified":"2026-10-06T20:03:40.690","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"},{"source":"go","sourceId":"GO-2026-6667","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"},{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"}]},{"url":"https://osv.dev/vulnerability/GHSA-q7hv-xx6h-q2x8","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://osv.dev/vulnerability/GHSA-q7hv-xx6h-q2x8"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://osv.dev/vulnerability/GHSA-q7hv-xx6h-q2x8"}]},{"url":"https://github.com/external-secrets/external-secrets","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://github.com/external-secrets/external-secrets"},{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://github.com/external-secrets/external-secrets"}]},{"url":"https://osv.dev/vulnerability/GO-2026-6667","tags":["ADVISORY"],"source":"go","sourceId":"GO-2026-6667","modified":"2026-10-20T00:45:10.097500666Z","origins":[{"source":"go","sourceId":"GO-2026-6667","url":"https://osv.dev/vulnerability/GO-2026-6667"},{"source":"go","sourceId":"GO-2026-6667","modified":"2026-10-20T00:45:10.097500666Z","url":"https://osv.dev/vulnerability/GO-2026-6667"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26287.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26287.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26287","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-26287"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546652","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546652"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26287","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-26287"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26287","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26287"}]},{"source":"euvd","sourceId":"EUVD-2026-93468","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93468","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-93468","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93468"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","url":"https://osv.dev/vulnerability/GHSA-q7hv-xx6h-q2x8","ecosystem":"Go","name":"github.com/external-secrets/external-secrets","purl":"pkg:golang/github.com/external-secrets/external-secrets","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.3.2"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q7hv-xx6h-q2x8/GHSA-q7hv-xx6h-q2x8.json"},"modified":"2026-10-20T00:55:45.081616683Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7hv-xx6h-q2x8","modified":"2026-10-20T00:55:45.081616683Z","url":"https://osv.dev/vulnerability/GHSA-q7hv-xx6h-q2x8"}]},{"source":"go","sourceId":"GO-2026-6667","url":"https://osv.dev/vulnerability/GO-2026-6667","ecosystem":"Go","name":"github.com/external-secrets/external-secrets","purl":"pkg:golang/github.com/external-secrets/external-secrets","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.3.2"}]}],"ecosystemSpecific":{},"databaseSpecific":{"source":"https://vuln.go.dev/ID/GO-2026-6667.json"},"modified":"2026-10-20T00:45:10.097500666Z","origins":[{"source":"go","sourceId":"GO-2026-6667","modified":"2026-10-20T00:45:10.097500666Z","url":"https://osv.dev/vulnerability/GO-2026-6667"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26287.json","productId":"external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-rhel9","product":"external-secrets-operator/external-secrets-rhel9 as a component of External Secrets Operator for Red Hat OpenShift","status":"known_affected","remediations":[{"category":"workaround","details":"Until an update is available, disable webhook generators when they are not required. Restrict permission to create Webhook generator resources, enforce the external-secrets.io/type=webhook label with an admission policy, and restrict egress from External Secrets Operator controller pods to approved destinations. Upgrade to a Red Hat product update containing External Secrets Operator 1.3.2 or later when available."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788?repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-26287","modified":"2026-10-07T11:08:00+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26287.json"}]}],"vendorCoverage":{"total":1,"shown":1,"omitted":0,"source":"redhat"}}