external-secrets records
4 published records for vendor external-secrets.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 75%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-269 Improper Privilege Management1
- CWE-277 Insecure Inherited Permissions1
- CWE-863 Incorrect Authorization1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
4 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2024-36540No exploit | Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service external-secrets · external secrets operator · CWE-277 | Critical9.8 | — | 0.4% | Jul 24, 2024 |
37Monitor | CVE-2026-22822No exploit | External Secrets Operator insecurely retrieves secrets through the getSecretKey templating functionexternal-secrets · external secrets operator · CWE-863 | Critical9.3 | — | 0.1% | Jan 21, 2026 |
35Monitor | CVE-2024-45041No exploit | External Secrets Operator vulnerable to privilege escalationexternal-secrets · external secrets operator · CWE-269 | High8.8 | — | 0.5% | Sep 9, 2024 |
28Monitor | CVE-2026-34984No exploit | External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engineexternal-secrets · external secrets operator · CWE-200 | High7.1 | — | 0.2% | Apr 13, 2026 |
- CVE-2024-3654039Monitor
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service
CriticalCVSS 9.8No exploitEPSS 0%external-secrets · external secrets operatorJul 24, 2024
- CVE-2026-2282237Monitor
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
CriticalCVSS 9.3No exploitEPSS 0%external-secrets · external secrets operatorJan 21, 2026
- CVE-2024-4504135Monitor
External Secrets Operator vulnerable to privilege escalation
HighCVSS 8.8No exploitEPSS 0%external-secrets · external secrets operatorSep 9, 2024
- CVE-2026-3498428Monitor
External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
HighCVSS 7.1No exploitEPSS 0%external-secrets · external secrets operatorApr 13, 2026