{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59341 exists.","fix":"No fix has been published for CVE-2026-59341 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-59341 is a medium-severity vulnerability in Bitnami sealed-secrets, published on 15 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-59341 and fix it if it is affected.\n\nWhat it is: CVE-2026-59341 is a medium-severity vulnerability in Bitnami sealed-secrets, published on 15 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59341 exists.\n\nAffected product: Bitnami sealed-secrets. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-59341/ (Markdown: https://insights.sbomify.com/CVE-2026-59341/index.md)","id":"CVE-2026-59341","markdown":"https://insights.sbomify.com/CVE-2026-59341/index.md","name":"CVE-2026-59341","record":{"aliases":["GHSA-qj4p-m373-p2wg"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes Sealed Secrets","requires_auth":"high_privilege","summary":"An attacker with internal network access can exploit a Go template injection flaw to decrypt and recover plaintext values from any sealed secret.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"vmware","cpe":[],"cvss":{"score":4.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-203","name":"Observable Discrepancy"}],"description":"A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full plaintext of any sealed secret.\n\nThe POST /v1/verify and /v1/rotate handlers call Unseal() to decrypt target secrets, then render any Go templates found in spec.template.data.* using the decrypted payload as the evaluation context (pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go). Errors encountered during template execution are directly reflected in the resulting HTTP response status codes.\n\nMissing AEAD label binding: the spec.template.data field is omitted from the AEAD authenticated-data label binding ciphertext to metadata. As a result, an attacker can copy a target's valid metadata and encryptedData verbatim, satisfying AEAD decryption and label validation, while freely replacing spec.template.data with arbitrary template logic.\n\nSide-channel oracle: template execution errors map directly to HTTP response codes. HTTP 200 (OK) indicates template execution succeeded; HTTP 409 (Conflict) indicates template execution failed (e.g. via {{ fail \"...\" }}).\n\nBy injecting conditional statements such as {{ if eq (substr 0 1 .password) \"S\" }}ok{{ else }}{{ fail \"x\" }}{{ end }}, an attacker receives an HTTP 200 status when a character guess is correct and an HTTP 409 when it is incorrect. This differential response leaks one character-equality bit per request, allowing full secret extraction over successive queries.\n\nAttack vector \u0026 prerequisites: unauthenticated; requires network access to the controller's internal service port (:8080). Although this service is not exposed to the public internet by default, it is accessible to any pod within the Kubernetes cluster or via a kubectl port-forward connection.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints","id":"CVE-2026-59341","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability","id":"CVE-2026-59346"},"packages":[],"prev":{"headline":"Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise","id":"CVE-2026-59335"},"products":["sealed-secrets"],"published":"2026-09-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-16","vendors":["Bitnami"]},"summary":"An attacker with internal network access can exploit a Go template injection flaw to decrypt and recover plaintext values from any sealed secret.","url":"https://insights.sbomify.com/CVE-2026-59341/"}