Go/github.com/external-secrets/external-secrets CVE-2025-55196: high 7.1, EPSS 0.37%

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

Action: Upgrade github.com/external-secrets/external-secrets to 0.19.2 or later.

go get github.com/external-secrets/external-secrets@v0.19.2

Affected

Fixed versions

Sources

• osv: GHSA-fcxq-v2r3-cc8h
• nvd: CVE-2025-55196
• https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h
• https://github.com/external-secrets/external-secrets/pull/5109
• https://github.com/external-secrets/external-secrets/pull/5133
• https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d
• https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1
• https://github.com/external-secrets/external-secrets

CVE-2025-55196 · published 2025-08-13T19:45:15Z · modified 2025-08-18T13:57:17.878658Z · JSON