CVE-2025-62159
BaseFortify
Publication date: 2025-10-10
Last updated on: 2025-10-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beyondtrust | external_secrets_operator | 0.20.0 |
| beyondtrust | external_secrets_operator | 0.19.2 |
| beyondtrust | external_secrets_operator | 0.10.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through 0.19.2. The provider retrieved Kubernetes secrets directly without validating the namespace context or the type of secret store. This flaw allowed unauthorized access to secrets across different namespaces, breaking security boundaries and potentially exposing sensitive credentials. The issue was fixed in version 0.20.0 by enforcing namespace validation and restricting cross-namespace access to only certain secret store types.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized cross-namespace access to Kubernetes secrets, which means an attacker or unauthorized user could access sensitive credentials or secrets from other namespaces. This exposure can compromise the security of applications and systems relying on those secrets, potentially leading to data breaches or unauthorized actions within the Kubernetes environment.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the External Secrets Operator BeyondTrust provider to version 0.20.0 or later, which includes the fix enforcing namespace validation. As a workaround, implement a policy engine such as Kyverno or OPA to prevent usage of the BeyondTrust provider and/or validate the (Cluster)SecretStore to ensure namespaces are only set when using a ClusterSecretStore.