All vulnerabilities
CVE-2026-26287GHSA-q7hv-xx6h-q2x8GO-2026-6667

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

external-secrets github.com/external-secrets/external-secretsgoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.3.2Fixed versionGitHub
Published6 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 1.3.2github.com/external-secrets/external-secrets, goGitHubgo get github.com/external-secrets/external-secrets@v1.3.2
  • 1.3.2github.com/external-secrets/external-secrets, GoOSVgo get github.com/external-secrets/external-secrets@v1.3.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag (EnforceLabels) after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped (and the operation to succeed while it should have failed with secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook.

Impact

A user with the permission to create webhook generator can set the webhook generator to a victim' secret (which was not previously labelled for webhook's use), and exfiltrate it to a malicious URL.

Mitigations

Until you upgrade, you can reduce risk by:

  • disabling webhook generators if not needed (or denying generators.external-secrets.io/v1alpha1 Webhook via an admission policy);
  • restricting RBAC: limit who can create generators of kind Webhook;
  • enforcing an admission policy (OPA Gatekeeper / Kyverno) requiring referenced secrets to be labeled external-secrets.io/type=webhook;
  • restricting egress from external-secrets controller pods to an allowlist (kubernetes NetworkPolicy / service mesh egress policy).

References

  • PR #5901 (fix: webhook initialization order)

Text from GitHub Advisory Database

Affected versions 3

  • github.com/external-secrets/external-secrets, go>= 0.10.0, < 1.3.2GitHub
  • external-secretsaffected: >= 0.10.0, < 1.3.2CVE List
  • github.com/external-secrets/external-secrets, Gofrom 0.10.0, fixed in 1.3.2OSV

References 5