CVE-2026-26287

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26287", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.415Z", "datePublished": "2026-10-06T15:31:56.088Z", "dateUpdated": "2026-10-06T17:21:44.292Z"}, "containers": {"cna": {"title": "External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration", "problemTypes": [{"descriptions": [{"cweId": "CWE-696", "lang": "en", "description": "CWE-696: Incorrect Behavior Order", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"}, {"name": "https://github.com/external-secrets/external-secrets/pull/5901", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/pull/5901"}, {"name": "https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"}, {"name": "https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"}], "affected": [{"vendor": "external-secrets", "product": "external-secrets", "versions": [{"version": ">= 0.10.0, < 1.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T15:31:56.088Z"}, "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch."}], "source": {"advisory": "GHSA-q7hv-xx6h-q2x8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T17:21:33.262411Z", "id": "CVE-2026-26287", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T17:21:44.292Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26287", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T17:21:33.262411Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T17:21:39.487Z"}}], "cna": {"title": "External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration", "source": {"advisory": "GHSA-q7hv-xx6h-q2x8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "external-secrets", "product": "external-secrets", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.3.2"}]}], "references": [{"url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8", "name": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/external-secrets/external-secrets/pull/5901", "name": "https://github.com/external-secrets/external-secrets/pull/5901", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba", "name": "https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2", "name": "https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-696", "description": "CWE-696: Incorrect Behavior Order"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T15:31:56.088Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26287", "state": "PUBLISHED", "dateUpdated": "2026-10-06T17:21:44.292Z", "dateReserved": "2026-02-12T17:10:53.415Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-06T15:31:56.088Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "external-secrets", "vendor": "external-secrets", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.3.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch."}], "id": "CVE-2026-26287", "lastModified": "2026-10-06T20:03:40.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26287", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T17:21:33.262411Z", "version": "2.0.3"}}]}, "published": "2026-10-06T16:17:07.180", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/pull/5901"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-696"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/external-secrets/external-secrets: external-secrets: Sensitive information disclosure via webhook generator label enforcement bypass", "id": "2546652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546652"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in external-secrets. An issue during webhook generator initialization incorrectly clears the label enforcement setting, bypassing provider-side validation. An authenticated user with permissions to create webhook generators can target arbitrary secrets lacking the required label and exfiltrate them to an external endpoint, resulting in unauthorized information disclosure."], "mitigation": {"lang": "en:us", "value": "Until an update is available, disable webhook generators when they are not required. Restrict permission to create Webhook generator resources, enforce the external-secrets.io/type=webhook label with an admission policy, and restrict egress from External Secrets Operator controller pods to approved destinations. Upgrade to a Red Hat product update containing External Secrets Operator 1.3.2 or later when available."}, "name": "CVE-2026-26287", "package_state": [{"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}], "public_date": "2026-10-06T15:31:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-26287\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26287\nhttps://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba\nhttps://github.com/external-secrets/external-secrets/pull/5901\nhttps://github.com/external-secrets/external-secrets/releases/tag/v1.3.2\nhttps://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"], "statement": "Red Hat is aware of a vulnerability in External Secrets Operator where label enforcement for webhook generators can be bypassed. An authorized user who can create a webhook generator may retrieve and exfiltrate a Secret that is not labeled for webhook use. Red Hat is preparing updates for affected products.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.10.0,1.3.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "external-secrets", "source": "cna", "vendor": "external-secrets"}, "product": "external-secrets", "vendor": "external-secrets"}], "created": "2026-10-06T18:15:04.039389+00:00", "updated": "2026-10-07T14:00:17.042460+00:00", "vendors": ["external-secrets", "external-secrets$PRODUCT$external-secrets"]}