← Back

CVE-2026-42876

nvd nist
Published: May 11, 2026Modified: Jun 17, 2026Deferred

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Exploitability: 1.8 / Impact: 2.7
Source: security-advisories@github.com (Secondary)

Description

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.

Related CWEs

CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (3)

Source: security-advisories@github.com
Source: security-advisories@github.com
Source: security-advisories@github.com

Timeline

No history available yet.