Go/github.com/external-secrets/external-secrets CVE-2026-22822: high 8.8, EPSS 0.19%

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

Action: Upgrade github.com/external-secrets/external-secrets to 1.2.0 or later.

go get github.com/external-secrets/external-secrets@v1.2.0

Affected

Fixed versions

Sources

• osv: GHSA-77v3-r3jw-j2v2
• nvd: CVE-2026-22822
• https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2
• https://github.com/external-secrets/external-secrets/issues/5690
• https://github.com/external-secrets/external-secrets/pull/3895
• https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb
• https://github.com/external-secrets/external-secrets
• https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0

CVE-2026-22822 · published 2026-01-20T16:37:18Z · modified 2026-04-16T02:14:29.314586906Z · JSON