{"action":"Upgrade github.com/external-secrets/external-secrets to 0.19.2 or later.","affected":[{"fixed":"0.19.2","introduced":"0.15.0"}],"component":"github.com/external-secrets/external-secrets","cve_ids":["CVE-2025-55196"],"ecosystem":"Go","epss":0.0037,"exploited":false,"fixed_versions":["0.19.2"],"ghsa_id":"GHSA-fcxq-v2r3-cc8h","id":"tcs_01M5KG9V1ZHB8ECH31SEY17ME4","modified_at":"2025-08-18T13:57:17.878658Z","published_at":"2025-08-18T13:17:23Z","references":["https://osv.dev/vulnerability/GO-2025-3885","https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h","https://nvd.nist.gov/vuln/detail/CVE-2025-55196","https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d","https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1","https://github.com/external-secrets/external-secrets/pull/5109","https://github.com/external-secrets/external-secrets/pull/5133"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GO-2025-3885","url":"https://osv.dev/vulnerability/GO-2025-3885"},{"source":"nvd","source_id":"CVE-2025-55196","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55196"}],"summary":"External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets"}