CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

What is CVE-2026-22822?

CVE-2026-22822 is a critical missing authorization vulnerability in external-secrets, published on 21 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.

Weakness: CWE-863

Which versions are affected by CVE-2026-22822?

3 open source packages ship an affected version, including github.com/external-secrets/external-secrets. It affects 1 product.

Products include External-Secrets External Secrets Operator.

How do I fix CVE-2026-22822?

Upgrade github.com/external-secrets/external-secrets to 1.2.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-22822 being exploited?

There is no known exploitation of CVE-2026-22822 in the wild and no public exploit code.

Other vulnerabilities in external-secrets

• CVE-2024-36540 Missing authorization in n/a Critical 9.8
• CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation High 8.3
• CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-77v3-r3jw-j2v2, GO-2026-4330, MINI-gw6m-9vh7-f9qw.