Go/github.com/external-secrets/external-secrets CVE-2026-26287: high 7.1
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
Action: Upgrade github.com/external-secrets/external-secrets to 1.3.2 or later.
go get github.com/external-secrets/external-secrets@v1.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.10.0 | 1.3.2 | - |
Fixed versions
| 1.3.2 |
Sources
- osv: GHSA-q7hv-xx6h-q2x8
- https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8
- https://github.com/external-secrets/external-secrets/pull/5901
- https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba
- https://github.com/external-secrets/external-secrets
- https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2
CVE-2026-26287 · published · modified · JSON