CVE-2026-42875
CA Material Bypass in External Secrets Operator
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| external_secrets | external_secrets | to 2.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-668 | The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a bypass of namespace isolation in Kubernetes Secrets management, potentially leading to a trust-boundary violation where one tenant can access CA material owned by another namespace.
While the direct risk of data exfiltration is low, the improper authorization and exposure of resources to the wrong sphere could raise concerns under compliance frameworks such as GDPR or HIPAA, which require strict access controls and data segregation.
Specifically, the violation of namespace boundaries may conflict with regulatory requirements for data isolation and confidentiality, potentially impacting compliance if sensitive information is accessed across tenant boundaries.
Can you explain this vulnerability to me?
This vulnerability occurs in the External Secrets Operator prior to version 2.4.0, where Namespaced SecretStore resources using CAProvider with type ConfigMap could resolve Certificate Authority (CA) material from a different namespace if the caProvider.namespace field was set.
This behavior bypasses the intended namespace isolation boundary that should prevent access to CA material outside the resource's own namespace.
As a result, a user or tenant could access CA material owned by another namespace, violating trust boundaries and potentially inferring the existence of ConfigMaps or keys in other namespaces.
How can this vulnerability impact me? :
The vulnerability allows a user to bypass namespace isolation and access CA material from other namespaces, which violates trust boundaries between tenants or components.
Although the direct risk of data exfiltration is low, this exposure could lead to unauthorized access to sensitive CA information and allow an attacker to infer the existence of resources in other namespaces.
This improper authorization and exposure of resources to the wrong sphere could undermine the security assumptions of multi-tenant Kubernetes environments.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the improper resolution of CA material across namespaces in Kubernetes when using External Secrets Operator versions prior to 2.4.0 with CAProvider of type ConfigMap. Detection involves verifying if any Namespaced SecretStore resources have the caProvider.namespace field set to a namespace different from their own.
You can inspect your Kubernetes cluster for SecretStore resources configured with CAProvider of type ConfigMap and check the caProvider.namespace field. For example, use kubectl commands to list and describe these resources.
- kubectl get secretstore --all-namespaces -o json | jq '.items[] | select(.spec.caProvider.type=="ConfigMap" and .spec.caProvider.namespace != null) | {namespace: .metadata.namespace, caProviderNamespace: .spec.caProvider.namespace}'
- kubectl describe secretstore <secretstore-name> -n <namespace> to manually inspect the caProvider.namespace field.
If you find SecretStore resources where caProvider.namespace is set to a different namespace, your system is potentially vulnerable to this namespace isolation bypass.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade the External Secrets Operator to version 2.4.0 or later, where this vulnerability is fixed.
Until the upgrade can be performed, review and restrict the use of caProvider.namespace in SecretStore resources to ensure it does not point to namespaces other than the one the SecretStore belongs to.
Additionally, enforce strict namespace boundaries and RBAC policies to limit access to ConfigMaps and SecretStores across namespaces.