{"action":"Upgrade sigs.k8s.io/secrets-store-sync-controller to 0.0.2 or later.","affected":[{"fixed":"0.0.2","introduced":"0"}],"component":"sigs.k8s.io/secrets-store-sync-controller","cve_ids":["CVE-2025-7445"],"ecosystem":"Go","epss":0.00195,"exploited":false,"fixed_versions":["0.0.2"],"ghsa_id":"GHSA-rcw7-pqfp-735x","id":"tcs_01M5KGA8E7DSN2HXTZQ2GGV9PZ","modified_at":"2026-03-03T04:57:27.686592Z","published_at":"2025-09-17T17:03:49Z","references":["https://osv.dev/vulnerability/GO-2025-3939","https://github.com/kubernetes-sigs/secrets-store-sync-controller/security/advisories/GHSA-rcw7-pqfp-735x","https://nvd.nist.gov/vuln/detail/CVE-2025-7445","https://github.com/kubernetes/kubernetes/issues/133897","https://groups.google.com/g/kubernetes-security-announce/c/NP7cQvQ1aGA"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GO-2025-3939","url":"https://osv.dev/vulnerability/GO-2025-3939"},{"source":"nvd","source_id":"CVE-2025-7445","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7445"}],"summary":"secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller"}