CVE-2026-42876
Description
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.
How to fix
- github.com/external-secrets/external-secrets/apis2.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/external-secrets/external-secrets/apisGo | 0.1.0 ≤ v < 2.4.1, No range specified | 2.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.