CVE-2025-55196
BaseFortify
Publication date: 2025-08-13
Last updated on: 2025-08-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| external-secrets | external-secrets | 0.19.2 |
| external-secrets | external-secrets | 0.15.0 |
| external-secrets | external-secrets | 0.19.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade External Secrets Operator to version 0.19.2 or later where the issue is patched. As a workaround, audit and restrict RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.
Can you explain this vulnerability to me?
This vulnerability in External Secrets Operator versions 0.15.0 to before 0.19.2 allows an attacker to bypass namespace restrictions when listing Kubernetes Secret and SecretStore resources. The PushSecret controller's List() calls did not apply a namespace selector, enabling an attacker who can create or update PushSecret resources and control SecretStore configurations to use label selectors to list and read secrets across the entire cluster. This can lead to unauthorized access and exfiltration of sensitive data such as credentials and tokens stored in Kubernetes secrets.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to full disclosure of Kubernetes secrets across namespaces, exposing sensitive information like credentials, tokens, and other secret data. This could compromise the security of your Kubernetes cluster and any applications relying on these secrets, potentially leading to unauthorized access, data breaches, and further exploitation within your environment.