{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22822", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.289Z", "datePublished": "2026-01-21T21:22:05.249Z", "dateUpdated": "2026-01-22T16:50:23.708Z"}, "containers": {"cna": {"title": "External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"}, {"name": "https://github.com/external-secrets/external-secrets/issues/5690", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/issues/5690"}, {"name": "https://github.com/external-secrets/external-secrets/pull/3895", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/pull/3895"}, {"name": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb"}, {"name": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0"}], "affected": [{"vendor": "external-secrets", "product": "external-secrets", "versions": [{"version": ">= 0.20.2, < 1.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:22:05.249Z"}, "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}], "source": {"advisory": "GHSA-77v3-r3jw-j2v2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:10:57.677512Z", "id": "CVE-2026-22822", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:50:23.708Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T15:10:57.677512Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:10:58.931Z"}}], "cna": {"title": "External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function", "source": {"advisory": "GHSA-77v3-r3jw-j2v2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "external-secrets", "product": "external-secrets", "versions": [{"status": "affected", "version": ">= 0.20.2, < 1.2.0"}]}], "references": [{"url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "name": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/external-secrets/external-secrets/issues/5690", "name": "https://github.com/external-secrets/external-secrets/issues/5690", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/pull/3895", "name": "https://github.com/external-secrets/external-secrets/pull/3895", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "name": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "name": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:22:05.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22822", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:50:23.708Z", "dateReserved": "2026-01-09T22:50:10.289Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T21:22:05.249Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource."}], "id": "CVE-2026-22822", "lastModified": "2026-01-21T22:15:49.380", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-01-21T22:15:49.380", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/issues/5690"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/pull/3895"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "external-secrets: External Secrets Operator: Cross-Namespace Secret Disclosure via `getSecretKey` Function", "id": "2431873", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431873"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-863", "details": ["External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.", "A flaw was found in the External Secrets Operator. A user with appropriate permissions could exploit a vulnerability in the `getSecretKey` template function. This function allowed secrets, which are sensitive pieces of information like passwords or API keys, to be retrieved from other isolated environments (known as namespaces) within OpenShift Container Platform, bypassing security mechanisms. This could lead to unauthorized access and disclosure of sensitive data."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of the `getSecretKey` function within any `ExternalSecret` resource. This will block the vulnerable function from being exploited. Applying such policies may require restarting affected pods or services for the changes to take effect."}, "name": "CVE-2026-22822", "package_state": [{"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-bundle", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:1", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-rhel9", "product_name": "External Secrets Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-bundle", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-operator-rhel9", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}, {"cpe": "cpe:/a:redhat:external_secrets_operator:0", "fix_state": "Affected", "package_name": "external-secrets-operator/external-secrets-rhel9", "product_name": "external secrets operator for Red Hat OpenShift - Tech Preview"}], "public_date": "2026-01-21T21:22:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22822\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22822\nhttps://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb\nhttps://github.com/external-secrets/external-secrets/issues/5690\nhttps://github.com/external-secrets/external-secrets/pull/3895\nhttps://github.com/external-secrets/external-secrets/releases/tag/v1.2.0\nhttps://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"], "statement": "This vulnerability is rated Important for Red Hat products, including External Secrets Operator for Red Hat OpenShift. The `getSecretKey` template function in affected versions of External Secrets Operator allows a user with an authenticated account to retrieve secrets from other Kubernetes namespaces, bypassing security controls. While this could lead to unauthorized disclosure of sensitive data, an attacker needs to already have valid login credentials.", "threat_severity": "Important"}