CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

What is CVE-2024-45041?

CVE-2024-45041 is a high-severity vulnerability in external-secrets, published on 9 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It also has path/update verb of validatingwebhookconfigurations resources. This can be used to abuse the SA token of the deployment to retrieve or get ALL secrets in the whole cluster, capture and log all data from requests attempting to update Secrets, or make a webhook deny all Pod create and update requests. This vulnerability is fixed in 0.10.2.

Weakness: CWE-732, CWE-269

Which versions are affected by CVE-2024-45041?

3 open source packages ship an affected version, including github.com/external-secrets/external-secrets. It affects 1 product.

Products include External-Secrets External Secrets Operator.

How do I fix CVE-2024-45041?

Upgrade github.com/external-secrets/external-secrets to 0.10.2 or later.

Is CVE-2024-45041 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45041 exists.

Other vulnerabilities in external-secrets

• CVE-2024-36540 Missing authorization in n/a Critical 9.8
• CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function Critical 9.3
• CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qwgc-rr35-h4x9, GO-2024-3126.