CVSS 3.1
4.9 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NCVE-2026-42876
Medium (4.9). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/external-secrets/external-secrets/apis 2.4.1.
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
- CWE
- CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fq7h-9x26-6j22 | Go | github.com/external-secrets/external-secrets/apis | >=0.1.0 <2.4.1 | 2.4.1 |
| GO-2026-5377 | Go | github.com/external-secrets/external-secrets/apis | all versions | no fix published |