External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access

Open Source Vulnerabilities GO-2025-3885

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets

Open Source Vulnerabilities GHSA-fcxq-v2r3-cc8h

## Summary A vulnerability was discovered in the External Secrets Operator where the `List()` calls for Kubernetes Secret and SecretStore resources performed by the `PushSecret` controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. --- ## Impact An attacker with the ability to create or update `PushSecret` resources and control `SecretStore` configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. --- ## Exploitability To exploit this vulnerability, an attacker must: 1. Have permissions to create or update `PushSecret` resources. 2. Control one or more `SecretStore` resources. With these conditions met, the attacker could leverage label selectors to list secrets from any namespace and retrieve their contents. --- ## Affected Versions - **Vulnerable:** v0.15.0 – v0.19.1 - **Not Vulnerable:** v0.19.2 and later --- ## Fix The vulnerability was addressed in v0.19.2 by adding namespace restrictions to the `List()` calls for both `PushSecret` and `SecretStore` controllers. This ensures that only secrets in the intended namespace are accessible. Relevant fixes: - [#5133](https://github.com/external-secrets/external-secrets/pull/5133) – Enforce namespace selector for PushSecret `List()` calls - [#5109](https://github.com/external-secrets/external-secrets/pull/5109) – Enforce namespace selector for SecretStore `List()` calls --- ## Mitigation If upgrading to v0.19.2 or later is not immediately possible, the following mitigations are recommended: - Restrict RBAC permissions so that only trusted service accounts can create or update `PushSecret` and `SecretStore` resources. - Audit existing `PushSecret` and `SecretStore` resources to ensure they are controlled by trusted parties. - Review Network Policies to prevent data exfiltration --- ## Credit This vulnerability was reported by @gracedo and @moolen

Open Source Vulnerabilities CVE-2025-55196

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.