CVE-2026-22822: Github.com/external secrets/external secrets External Secrets Operator Insecurely Retrieves Vulnerability
CRITICALCVE-2026-22822 is a CRITICAL external secrets operator insecurely retrieves vulnerability (CWE-863: Incorrect Authorization) affecting Github.com/external secrets/external secrets libraries in the Go ecosystem. The issue involves external secrets operator insecurely retrieves secrets through the getsecretkey templating function. Remediation is available by upgrading affected packages to version 1.2.0.
CVE-2026-22822 at a Glance
How to Fix CVE-2026-22822
To remediate this vulnerability, upgrade all affected Github.com/external secrets/external secrets dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/external-secrets/external-secrets to 1.2.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/external-secrets/external-secretsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-22822, inspect your project dependencies for Github.com/external secrets/external secrets:
inspect dependencies for github.com/external-secrets/external-secretsAnalyze the terminal output to locate any version of Github.com/external secrets/external secrets in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Github.com/external secrets/external secrets, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-22822 Affected Github.com/external secrets/external secrets Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/external-secrets/external-secrets
|
Go |
≥ 0.20.2
< 1.2.0
|
1.2.0
|
References
Frequently Asked Questions
What is CVE-2026-22822?
Which Github.com/external secrets/external secrets versions are affected?
What version fixes CVE-2026-22822?
Is github.com/external-secrets/external-secrets affected?
What CWE is associated with CVE-2026-22822?
How can I check Go dependencies for CVE-2026-22822?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-77v3-r3jw-j2v2",
"modified" : "2026-01-22T15:38:48Z",
"published" : "2026-01-20T16:37:18Z",
"aliases" : [ "CVE-2026-22822" ],
"summary" : "External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function",
"details" : "### Summary\n\nThe `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms.\n\nThis function was completely removed, as everything done with that templating function can be done in a different way while respecting our safeguards (for example, using `sourceRef` like explained here: https://github.com/external-secrets/external-secrets/issues/5690#issuecomment-3630977865)\n\n### Impact\n- Cross-namespace secret access: Attackers or misconfigured resources could retrieve secrets from namespaces other than the one intended.\n- privilege escalation: Unauthorized access to secrets could lead to privilege escalation, data exfiltration, or compromise of service accounts and credentials.\n\n### Resolution\n\nWe removed the incriminated templating function from our codebase. All users should upgrade to the latest version containing this fix.\n\n### Workarounds\n\nUse a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.\n\n### Details\n\nSee also:\n- https://github.com/external-secrets/external-secrets/issues/5690\n- https://github.com/external-secrets/external-secrets/pull/3895",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/external-secrets/external-secrets"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.20.2"
}, {
"fixed" : "1.2.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-22822"
}, {
"type" : "WEB",
"url" : "https://github.com/external-secrets/external-secrets/issues/5690"
}, {
"type" : "WEB",
"url" : "https://github.com/external-secrets/external-secrets/pull/3895"
}, {
"type" : "WEB",
"url" : "https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/external-secrets/external-secrets"
}, {
"type" : "WEB",
"url" : "https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-863" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-20T16:37:18Z",
"nvd_published_at" : "2026-01-21T22:15:49Z"
}
}