PT-2026-6506 · Go · Github.Com/External-Secrets/External-Secrets

Published 2026-02-03 · Updated 2026-02-03

OSV

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

Related Identifiers

GO-2026-4330

Affected Products

Github.Com/External-Secrets/External-Secrets

References · 6

• https://osv.dev/vulnerability/GO-2026-4330 · Vendor Advisory
• https://github.com/external-secrets/external-secrets/pull/3895 · Note
• https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb · Note
• https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0 · Note
• https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2 · Note
• https://github.com/external-secrets/external-secrets/issues/5690 · Note