PT-2026-22072 · Bitnami · Bitnami Sealed Secrets
1Seal
·
Published
2026-02-26
·
Updated
2026-03-25
·
CVE-2026-22728
CVSS v3.1
4.9
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Bitnami Sealed Secrets (affected versions not specified)
Description
Bitnami Sealed Secrets is susceptible to a scope-widening attack during the secret rotation process via the
/v1/rotate API endpoint. The rotation handler uses untrusted data from spec.template.metadata.annotations within the input SealedSecret to determine the sealing scope for the rotated output. An attacker can exploit this by injecting the annotation sealedsecrets.bitnami.com/cluster-wide=true into the template metadata of a submitted SealedSecret. This allows the attacker to obtain a rotated, cluster-wide version of the secret, bypassing original scope restrictions and enabling them to unseal the secret in any namespace or under any name, potentially recovering plaintext credentials.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bitnami Sealed Secrets