{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22822.json" } ], "title": "external-secrets: External Secrets Operator: Cross-Namespace Secret Disclosure via `getSecretKey` Function", "tracking": { "current_release_date": "2026-06-30T04:15:04+00:00", "generator": { "date": "2026-06-30T04:15:04+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.0" } }, "id": "CVE-2026-22822", "initial_release_date": "2026-01-21T21:22:05.249000+00:00", "revision_history": [ { "date": "2026-01-21T21:22:05.249000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-03-16T08:31:18+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-30T04:15:04+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "External Secrets Operator for Red Hat OpenShift", "product": { "name": "External Secrets Operator for Red Hat OpenShift", "product_id": "external_secrets_operator_for_red_hat_openshift", "product_identification_helper": { "cpe": "cpe:/a:redhat:external_secrets_operator:1" } } } ], "category": "product_family", "name": "External Secrets Operator for Red Hat OpenShift" }, { "branches": [ { "category": "product_name", "name": "external secrets operator for Red Hat OpenShift - Tech Preview", "product": { "name": "external secrets operator for Red Hat OpenShift - Tech Preview", "product_id": "external_secrets_operator_for_red_hat_openshift_-_tech_preview", "product_identification_helper": { "cpe": "cpe:/a:redhat:external_secrets_operator:0" } } } ], "category": "product_family", "name": "external secrets operator for Red Hat OpenShift - Tech Preview" }, { "category": "product_version", "name": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product": { "name": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product_id": "external-secrets-operator/bitwarden-sdk-server-rhel9", "product_identification_helper": { "purl": "pkg:oci/bitwarden-sdk-server-rhel9?repository_url=registry.redhat.io/external-secrets-operator/bitwarden-sdk-server-rhel9" } } }, { "category": "product_version", "name": "external-secrets-operator/external-secrets-operator-bundle", "product": { "name": "external-secrets-operator/external-secrets-operator-bundle", "product_id": "external-secrets-operator/external-secrets-operator-bundle", "product_identification_helper": { "purl": "pkg:oci/external-secrets-operator-bundle?repository_url=registry.redhat.io/external-secrets-operator/external-secrets-operator-bundle" } } }, { "category": "product_version", "name": "external-secrets-operator/external-secrets-operator-rhel9", "product": { "name": "external-secrets-operator/external-secrets-operator-rhel9", "product_id": "external-secrets-operator/external-secrets-operator-rhel9", "product_identification_helper": { "purl": "pkg:oci/external-secrets-operator-rhel9?repository_url=registry.redhat.io/external-secrets-operator/external-secrets-operator-rhel9" } } }, { "category": "product_version", "name": "external-secrets-operator/external-secrets-rhel9", "product": { "name": "external-secrets-operator/external-secrets-rhel9", "product_id": "external-secrets-operator/external-secrets-rhel9", "product_identification_helper": { "purl": "pkg:oci/external-secrets-rhel9?repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/bitwarden-sdk-server-rhel9 as a component of External Secrets Operator for Red Hat OpenShift", "product_id": "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/bitwarden-sdk-server-rhel9" }, "product_reference": "external-secrets-operator/bitwarden-sdk-server-rhel9", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/external-secrets-operator-bundle as a component of External Secrets Operator for Red Hat OpenShift", "product_id": "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-bundle" }, "product_reference": "external-secrets-operator/external-secrets-operator-bundle", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/external-secrets-operator-rhel9 as a component of External Secrets Operator for Red Hat OpenShift", "product_id": "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-rhel9" }, "product_reference": "external-secrets-operator/external-secrets-operator-rhel9", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/external-secrets-rhel9 as a component of External Secrets Operator for Red Hat OpenShift", "product_id": "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-rhel9" }, "product_reference": "external-secrets-operator/external-secrets-rhel9", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/bitwarden-sdk-server-rhel9 as a component of external secrets operator for Red Hat OpenShift - Tech Preview", "product_id": "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/bitwarden-sdk-server-rhel9" }, "product_reference": "external-secrets-operator/bitwarden-sdk-server-rhel9", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift_-_tech_preview" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/external-secrets-operator-bundle as a component of external secrets operator for Red Hat OpenShift - Tech Preview", "product_id": "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-bundle" }, "product_reference": "external-secrets-operator/external-secrets-operator-bundle", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift_-_tech_preview" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/external-secrets-operator-rhel9 as a component of external secrets operator for Red Hat OpenShift - Tech Preview", "product_id": "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-rhel9" }, "product_reference": "external-secrets-operator/external-secrets-operator-rhel9", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift_-_tech_preview" }, { "category": "default_component_of", "full_product_name": { "name": "external-secrets-operator/external-secrets-rhel9 as a component of external secrets operator for Red Hat OpenShift - Tech Preview", "product_id": "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-rhel9" }, "product_reference": "external-secrets-operator/external-secrets-rhel9", "relates_to_product_reference": "external_secrets_operator_for_red_hat_openshift_-_tech_preview" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-22822", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2026-01-21T22:01:44.507685+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-rhel9" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2431873" } ], "notes": [ { "category": "description", "text": "A flaw was found in the External Secrets Operator. A user with appropriate permissions could exploit a vulnerability in the `getSecretKey` template function. This function allowed secrets, which are sensitive pieces of information like passwords or API keys, to be retrieved from other isolated environments (known as namespaces) within OpenShift Container Platform, bypassing security mechanisms. This could lead to unauthorized access and disclosure of sensitive data.", "title": "Vulnerability description" }, { "category": "summary", "text": "external-secrets: External Secrets Operator: Cross-Namespace Secret Disclosure via `getSecretKey` Function", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated Important for Red Hat products, including External Secrets Operator for Red Hat OpenShift. The `getSecretKey` template function in affected versions of External Secrets Operator allows a user with an authenticated account to retrieve secrets from other Kubernetes namespaces, bypassing security controls. While this could lead to unauthorized disclosure of sensitive data, an attacker needs to already have valid login credentials.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-rhel9" ], "known_not_affected": [ "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-rhel9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-22822" }, { "category": "external", "summary": "RHBZ#2431873", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431873" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22822", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22822" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22822", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22822" }, { "category": "external", "summary": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb", "url": "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb" }, { "category": "external", "summary": "https://github.com/external-secrets/external-secrets/issues/5690", "url": "https://github.com/external-secrets/external-secrets/issues/5690" }, { "category": "external", "summary": "https://github.com/external-secrets/external-secrets/pull/3895", "url": "https://github.com/external-secrets/external-secrets/pull/3895" }, { "category": "external", "summary": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0", "url": "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0" }, { "category": "external", "summary": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2", "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2" } ], "release_date": "2026-01-21T21:22:05.249000+00:00", "remediations": [ { "category": "workaround", "details": "To mitigate this issue, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of the `getSecretKey` function within any `ExternalSecret` resource. This will block the vulnerable function from being exploited. Applying such policies may require restarting affected pods or services for the changes to take effect.", "product_ids": [ "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-rhel9" ] }, { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift:external-secrets-operator/external-secrets-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/bitwarden-sdk-server-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-bundle", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-operator-rhel9", "external_secrets_operator_for_red_hat_openshift_-_tech_preview:external-secrets-operator/external-secrets-rhel9" ] } ], "title": "external-secrets: External Secrets Operator: Cross-Namespace Secret Disclosure via `getSecretKey` Function" } ] }