Go/github.com/external-secrets/external-secrets/apis CVE-2026-42876: medium 4.9, EPSS 0.21%

ExternalSecrets vulnerable to privilege escalation with secret overwriting

Action: Upgrade github.com/external-secrets/external-secrets/apis to 2.4.1 or later.

go get github.com/external-secrets/external-secrets/apis@v2.4.1

Affected

Fixed versions

Sources

• osv: GHSA-fq7h-9x26-6j22
• https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fq7h-9x26-6j22
• https://nvd.nist.gov/vuln/detail/CVE-2026-42876
• https://github.com/external-secrets/external-secrets/commit/4ddd240af7fe88725d9857b9a0c198073502e288
• https://github.com/external-secrets/external-secrets
• https://github.com/external-secrets/external-secrets/releases/tag/v2.4.1

CVE-2026-42876 · published 2026-05-08T17:24:15Z · modified 2026-09-10T03:50:46.751702127Z · JSON