GHSA-q7hv-xx6h-q2x8

Source

https://github.com/advisories/GHSA-q7hv-xx6h-q2x8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q7hv-xx6h-q2x8/GHSA-q7hv-xx6h-q2x8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q7hv-xx6h-q2x8

Aliases

CVE-2026-26287

Published

2026-10-06T15:29:25Z

Modified

2026-10-06T15:46:48Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

Details

Summary

A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag (EnforceLabels) after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped (and the operation to succeed while it should have failed with secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook.

Impact

A user with the permission to create webhook generator can set the webhook generator to a victim' secret (which was not previously labelled for webhook's use), and exfiltrate it to a malicious URL.

Mitigations

Until you upgrade, you can reduce risk by:

disabling webhook generators if not needed (or denying generators.external-secrets.io/v1alpha1 Webhook via an admission policy);
restricting RBAC: limit who can create generators of kind Webhook;
enforcing an admission policy (OPA Gatekeeper / Kyverno) requiring referenced secrets to be labeled external-secrets.io/type=webhook;
restricting egress from external-secrets controller pods to an allowlist (kubernetes NetworkPolicy / service mesh egress policy).

References

PR #5901 (fix: webhook initialization order)

Database specific

{
    "cwe_ids": [
        "CWE-696"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T15:29:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/external-secrets/external-secrets

Package

Name: github.com/external-secrets/external-secrets; View open source insights on deps.dev
Purl: pkg:golang/github.com/external-secrets/external-secrets

Affected ranges

Type: SEMVER
Events: Introduced

0.10.0

Fixed

1.3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q7hv-xx6h-q2x8/GHSA-q7hv-xx6h-q2x8.json"