CVE-2026-42876
Privilege Escalation in External Secrets Operator
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| external_secrets_operator | external_secrets_operator | 2.4.1 |
| external_secrets | external_secrets | 2.4.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-42876 is a privilege escalation vulnerability in the External Secrets Operator (ESO). It occurs when a user with permission to create ExternalSecret resources can cause the operator to create a Kubernetes Secret containing a long-lived token for a specified service account. This token allows the user to impersonate any service account in the namespace without needing direct permissions on TokenRequest or Secrets of that type.
The vulnerability arises because the operator does not properly validate the creation of certain secret types and annotations, enabling users to generate tokens that exceed their intended permissions.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited permissions to escalate their privileges by impersonating service accounts within a Kubernetes namespace. By obtaining long-lived tokens for these service accounts, the attacker can perform actions on behalf of those accounts, potentially accessing sensitive resources or performing unauthorized operations.
However, exploitation requires the attacker to already have permissions nearly equivalent to the escalation, and the impact on confidentiality and integrity is considered low to moderate.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking ExternalSecret resources for forbidden secret types and annotations that could lead to privilege escalation.
Specifically, look for ExternalSecrets that create secrets of type 'kubernetes.io/service-account-token' with the annotation 'kubernetes.io/service-account.name' or use 'templateFrom' with the 'Annotations' target.
You can use kubectl commands to list ExternalSecret resources and inspect their templates for these characteristics.
- kubectl get externalsecrets --all-namespaces -o yaml | grep -A10 'type: kubernetes.io/service-account-token'
- kubectl get externalsecrets --all-namespaces -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{.spec.template.metadata.annotations}{"\n"}{end}' | grep 'kubernetes.io/service-account.name'
These commands help identify ExternalSecrets that may be exploiting the vulnerability by creating privileged tokens.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows users with limited permissions to impersonate service accounts by generating long-lived tokens without proper authorization. Such unauthorized access and privilege escalation could lead to unauthorized data access or manipulation within Kubernetes environments.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to impersonate service accounts and potentially access sensitive data could pose risks to data confidentiality and integrity, which are critical aspects of these regulations.
Therefore, organizations using affected versions of External Secrets Operator prior to 2.4.1 might face challenges in maintaining compliance with data protection regulations if this vulnerability is exploited, as it undermines access controls and could lead to unauthorized data exposure.
What immediate steps should I take to mitigate this vulnerability?
Upgrade External Secrets Operator to version 2.4.1 or later, where the vulnerability is fixed by validation preventing creation of privileged secret types.
Implement admission control logic to block ExternalSecrets that attempt to create service account tokens or use forbidden template annotations.
Disable Service Account Token generation via kube-controller-manager flags if possible.
Restrict user RBAC permissions in production clusters to limit who can create ExternalSecret resources.