PT-2025-33101 · External Secrets · External Secrets Operator

Published 2025-08-13 · Updated 2025-08-20 · CVE-2025-55196

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: External Secrets Operator versions 0.15.0 through 0.19.1

Description: A flaw was discovered in the External Secrets Operator where List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this to exfiltrate sensitive data from arbitrary namespaces, potentially leading to full disclosure of Kubernetes secrets, including credentials and tokens.

Recommendations: Update to version 0.19.2 or later to resolve this issue. Restrict RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources. Audit existing PushSecret and SecretStore resources to ensure they are controlled by trusted parties.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-55196

GHSA-FCXQ-V2R3-CC8H

GO-2025-3885

OPENSUSE-SU-2025:15469-1

Affected Products

External Secrets Operator

References · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55196.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55196 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fcxq-v2r3-cc8h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3885 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55196 · Vendor Advisory
• https://github.com/external-secrets/external-secrets · Note
• https://github.com/external-secrets/external-secrets/pull/5133 · Note
• https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d · Note
• https://github.com/external-secrets/external-secrets/pull/5109 · Note
• https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h · Note
• https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1 · Note
• https://t.me/CVEtracker/29948 · Telegram Post
• https://suse.com/security/cve/CVE-2023-26154 · Note
• https://suse.com/security/cve/CVE-2025-53910 · Note