CVE-2026-59341
Received Received - Intake

Sealed Secrets Controller Template Injection and Decryption Oracle

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VMware

Description
A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full plaintext of any sealed secret. The POST /v1/verify and /v1/rotate handlers call Unseal() to decrypt target secrets, then render any Go templates found in spec.template.data.* using the decrypted payload as the evaluation context (pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go). Errors encountered during template execution are directly reflected in the resulting HTTP response status codes. Missing AEAD label binding: the spec.template.data field is omitted from the AEAD authenticated-data label binding ciphertext to metadata. As a result, an attacker can copy a target's valid metadata and encryptedData verbatim, satisfying AEAD decryption and label validation, while freely replacing spec.template.data with arbitrary template logic. Side-channel oracle: template execution errors map directly to HTTP response codes. HTTP 200 (OK) indicates template execution succeeded; HTTP 409 (Conflict) indicates template execution failed (e.g. via {{ fail "..." }}). By injecting conditional statements such as {{ if eq (substr 0 1 .password) "S" }}ok{{ else }}{{ fail "x" }}{{ end }}, an attacker receives an HTTP 200 status when a character guess is correct and an HTTP 409 when it is incorrect. This differential response leaks one character-equality bit per request, allowing full secret extraction over successive queries. Attack vector & prerequisites: unauthenticated; requires network access to the controller's internal service port (:8080). Although this service is not exposed to the public internet by default, it is accessible to any pod within the Kubernetes cluster or via a kubectl port-forward connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-59341
EUVD
EUVD-2026-78349

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vmware sealed_secrets *
bitnami sealed_secrets to 0.38.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59341 is a template injection vulnerability in the Sealed Secrets controller's unauthenticated POST endpoints. An attacker with internal network access can exploit this to decrypt sealed secrets by using the controller as a decryption oracle. The issue occurs because the controller decrypts secrets and then renders Go templates using the decrypted data, with template execution errors reflected in HTTP status codes. This allows an attacker to leak plaintext one character at a time by observing HTTP 200 (success) or 409 (failure) responses.

Detection Guidance

Check if the sealed-secrets controller is exposed on port 8080 within your cluster. Use commands like 'kubectl get svc -n <namespace>' to find services and 'kubectl port-forward svc/<sealed-secrets-service> 8080:8080' to test local access. Monitor HTTP responses from /v1/verify and /v1/rotate endpoints for inconsistent status codes (200 vs 409) which may indicate template execution attempts.

Impact Analysis

This vulnerability allows an attacker with network access to the Sealed Secrets controller (port 8080) to decrypt any sealed secret stored in the cluster. This could lead to unauthorized access to sensitive data such as passwords, API keys, or certificates. The attack requires internal network access but can be exploited via kubectl port-forward even if the service is not internet-facing.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized decryption of secrets could result in data breaches, triggering mandatory breach notification requirements and potential fines or penalties for non-compliance.

Mitigation Strategies

Upgrade the sealed-secrets controller to a version beyond v0.38.4. If immediate upgrade is not possible, restrict network access to the controller's port 8080 using Kubernetes NetworkPolicies or firewall rules. Disable unauthenticated access to /v1/verify and /v1/rotate endpoints if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59341. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart