VYPR
Get started
← All advisories
High severityNVD Advisory· Published Sep 9, 2024· Updated Sep 9, 2024

External Secrets Operator vulnerable to privilege escalation

CVE-2024-45041

Description

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It also has path/update verb of validatingwebhookconfigurations resources. This can be used to abuse the SA token of the deployment to retrieve or get ALL secrets in the whole cluster, capture and log all data from requests attempting to update Secrets, or make a webhook deny all Pod create and update requests. This vulnerability is fixed in 0.10.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/external-secrets/external-secretsGo
< 0.10.20.10.2

Affected products

1

Patches

2
0368b9806f66

fix: add watch to validatingwebhookconfigs (#3845)

https://github.com/external-secrets/external-secretsGustavo Fernandes de CarvalhoAug 28, 2024via ghsa
commit
1 file changed · +2 −2
  • deploy/charts/external-secrets/templates/cert-controller-rbac.yaml+2 −2 modified
    @@ -22,6 +22,8 @@ rules:
     - "validatingwebhookconfigurations"
     verbs:
     - "list"
+    - "watch"
+    - "get"
   - apiGroups:
     - "admissionregistration.k8s.io"
     resources:
@@ -30,8 +32,6 @@ rules:
     - "secretstore-validate"
     - "externalsecret-validate"
     verbs:
-    - "get"
-    - "watch"
     - "update"
     - "patch"
   - apiGroups:
428a452fd2ad

add the resourceNames(git commit -s) (#3822)

https://github.com/external-secrets/external-secretsyounamanAug 27, 2024via ghsa
commit
2 files changed · +10 −2
  • deploy/charts/external-secrets/templates/cert-controller-rbac.yaml+9 −1 modified
    @@ -21,8 +21,16 @@ rules:
     resources:
     - "validatingwebhookconfigurations"
     verbs:
-    - "get"
     - "list"
+  - apiGroups:
+    - "admissionregistration.k8s.io"
+    resources:
+    - "validatingwebhookconfigurations"
+    resourceNames:
+    - "secretstore-validate"
+    - "externalsecret-validate"
+    verbs:
+    - "get"
     - "watch"
     - "update"
     - "patch"
  • deploy/charts/external-secrets/tests/__snapshot__/crds_test.yaml.snap+1 −1 modified
    @@ -4,7 +4,7 @@ should match snapshot of default values:
     kind: CustomResourceDefinition
     metadata:
       annotations:
-        controller-gen.kubebuilder.io/version: v0.15.0
+        controller-gen.kubebuilder.io/version: v0.16.1
       labels:
         external-secrets.io/component: controller
       name: secretstores.external-secrets.io

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.