{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22822", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.289Z", "datePublished": "2026-01-21T21:22:05.249Z", "dateUpdated": "2026-01-22T16:50:23.708Z"}, "containers": {"cna": {"title": "External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"}, {"name": "https://github.com/external-secrets/external-secrets/issues/5690", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/issues/5690"}, {"name": "https://github.com/external-secrets/external-secrets/pull/3895", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/pull/3895"}, {"name": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb"}, {"name": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0"}], "affected": [{"vendor": "external-secrets", "product": "external-secrets", "versions": [{"version": ">= 0.20.2, < 1.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:22:05.249Z"}, "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}], "source": {"advisory": "GHSA-77v3-r3jw-j2v2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:10:57.677512Z", "id": "CVE-2026-22822", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:50:23.708Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T15:10:57.677512Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:10:58.931Z"}}], "cna": {"title": "External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function", "source": {"advisory": "GHSA-77v3-r3jw-j2v2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "external-secrets", "product": "external-secrets", "versions": [{"status": "affected", "version": ">= 0.20.2, < 1.2.0"}]}], "references": [{"url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "name": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/external-secrets/external-secrets/issues/5690", "name": "https://github.com/external-secrets/external-secrets/issues/5690", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/pull/3895", "name": "https://github.com/external-secrets/external-secrets/pull/3895", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "name": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "name": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:22:05.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22822", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:50:23.708Z", "dateReserved": "2026-01-09T22:50:10.289Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T21:22:05.249Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:external-secrets:external_secrets_operator:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9E0E951-2317-45FB-A1AD-7426EFBBA6E3", "versionEndExcluding": "1.2.0", "versionStartIncluding": "0.20.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}], "id": "CVE-2026-22822", "lastModified": "2026-02-18T15:29:01.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-01-21T22:15:49.380", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/external-secrets/external-secrets/issues/5690"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/external-secrets/external-secrets/pull/3895"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "external-secrets: External Secrets Operator: Cross-Namespace Secret Disclosure via `getSecretKey` Function", "id": "2431873", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431873"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-863", "details": ["External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.", "A flaw was found in the External Secrets Operator. A user with appropriate permissions could exploit a vulnerability in the `getSecretKey` template function. This function allowed secrets, which are sensitive pieces of information like passwords or API keys, to be retrieved from other isolated environments (known as namespaces) within OpenShift Container Platform, bypassing security mechanisms. This could lead to unauthorized access and disclosure of sensitive data."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of the `getSecretKey` function within any `ExternalSecret` resource. This will block the vulnerable function from being exploited. Applying such policies may require restarting affected pods or services for the changes to take effect."}, "name": "CVE-2026-22822", "package_state": [{"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-bundle", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-bundle", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-rhel9", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-rhel9", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}], "public_date": "2026-01-21T21:22:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22822\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22822\nhttps://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb\nhttps://github.com/external-secrets/external-secrets/issues/5690\nhttps://github.com/external-secrets/external-secrets/pull/3895\nhttps://github.com/external-secrets/external-secrets/releases/tag/v1.2.0\nhttps://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"], "statement": "This vulnerability is rated Important for Red Hat products, including External Secrets Operator for Red Hat OpenShift. The `getSecretKey` template function in affected versions of External Secrets Operator allows a user with an authenticated account to retrieve secrets from other Kubernetes namespaces, bypassing security controls. While this could lead to unauthorized disclosure of sensitive data, an attacker needs to already have valid login credentials.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T04:10:28.404632+00:00", "value": {"mitigation_remediation": ["Upgrade the External Secrets Operator to version 1.2.0 or later, which removes the getSecretKey templating function entirely.", "If an immediate upgrade is not feasible, deploy a policy engine such as Kyverno, Kubewarden, or OPA to enforce a rule that denies any ExternalSecret resource containing the getSecretKey function.", "Review existing ExternalSecret manifests for getSecretKey usage and replace them with alternative secret retrieval methods that respect namespace boundaries.", "Restrict the roleBinding granted to the External Secrets controller so that it cannot perform cross\u2011namespace secret retrieval; ensure it only has permissions for its own namespace."], "summary": {"action": "Patch Now", "impact": "Secret Disclosure"}, "threat_synthesis": {"affected_systems": "The affected vendor is external\u2011secrets, and the product is the External Secrets Operator. Versions 0.20.2 through 1.1.x are vulnerable; the function was removed in version 1.2.0, so any deployment running a version prior to that release is impacted. No other vendors or products are mentioned in the CNA list.", "description_and_impact": "External Secrets Operator allows an attacker to retrieve Kubernetes secrets from any namespace by leveraging the getSecretKey templating function. This function was intended for use with the senhasegura Devops Secrets Management provider but can also be abused to access secrets outside the authorized namespace. The vulnerability stems from a missing access control check (CWE\u2011863) and permits the execution of arbitrary secret retrieval across namespaces, resulting in a breach of confidentiality for secrets that should be isolated within their own namespace.", "risk_and_exploitability": "The CVSS score of 9.3 indicates a high severity level, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector for exploitation is an internal attacker or a compromised component that can create or modify ExternalSecret resources; by embedding getSecretKey calls, the attacker can read secrets from namespaces they should not access. Mitigation requires local changes rather than external network exposure, so the threat is contained within the cluster environment."}}}}, "created": "2026-01-22T10:08:30.145606+00:00", "updated": "2026-04-18T04:15:05.878245+00:00", "vendors": ["external-secrets", "external-secrets$PRODUCT$external-secrets"]}