CVE-2026-42875: Github.com/external secrets/external secrets External Secrets Operator Has Namespace Vulnerability

MODERATE
Advisory Identifier: GHSA-wv26-88m5-6h59
Share
CWE-668 CWE-285
Published
Advisory Summary

CVE-2026-42875 is a MODERATE external secrets operator has namespace vulnerability (CWE-668: Exposure of Resource to Wrong Sphere) affecting Github.com/external secrets/external secrets libraries in the Go ecosystem. The issue involves external secrets operator has namespace isolation bypass in caprovider configmap resolution for secretstore. Remediation is available by upgrading affected packages to version 2.4.0.

CVE-2026-42875 at a Glance

CVE Identifier CVE-2026-42875
GHSA Identifier GHSA-wv26-88m5-6h59
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-668: Exposure of Resource to Wrong Sphere
Affected Product Github.com/external secrets/external secrets
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2026-42875

To remediate this vulnerability, upgrade all affected Github.com/external secrets/external secrets dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/external-secrets/external-secrets fixed: 2.4.0 
Upgrade github.com/external-secrets/external-secrets to 2.4.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/external-secrets/external-secrets

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-42875, inspect your project dependencies for Github.com/external secrets/external secrets:

inspect dependencies for github.com/external-secrets/external-secrets

Analyze the terminal output to locate any version of Github.com/external secrets/external secrets in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.4.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-668: Exposure of Resource to Wrong Sphere, where the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. In Github.com/external secrets/external secrets, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Namespaced SecretStore resources that used CAProvider with type `ConfigMap` could resolve CA material from another namespace when `caProvider.namespace` was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. The accessible data is used as CA validation material, hence it is not directly exposed. Impact: - Direct data exfiltration risk: low - Existence disclosure: an attacker can infer whether a target ConfigMap/key exists in another namespace. - Trust-boundary violation: a tenant can make its SecretStore consume CA material owned by another namespace.

CVE-2026-42875 Affected Github.com/external secrets/external secrets Versions

1 component(s)
Fixed Versions:
2.4.0
Product / Package Ecosystem Affected Versions Fixed Version
github.com/external-secrets/external-secrets
golang/github.com/external-secrets/external-secrets
Go
< 2.4.0
2.4.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/external-secrets/external-secrets/security/advisories/GHSA-wv26-88m5-6h59
NVD — CVE-2026-42875 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42875
Github.com/external secrets/external secrets Source Repository REPOSITORY
https://github.com/external-secrets/external-secrets

Frequently Asked Questions

What is CVE-2026-42875?
CVE-2026-42875 is a security vulnerability in Github.com/external secrets/external secrets involving External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore under CWE-668: Exposure of Resource to Wrong Sphere.
Which Github.com/external secrets/external secrets versions are affected?
Affected versions include releases prior to 2.4.0 across affected packages: github.com/external-secrets/external-secrets.
What version fixes CVE-2026-42875?
Upgrading to 2.4.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/external-secrets/external-secrets affected?
Yes, github.com/external-secrets/external-secrets is affected in releases prior to 2.4.0. Upgrade your dependency to 2.4.0 or later.
What CWE is associated with CVE-2026-42875?
CVE-2026-42875 is classified under CWE-668: Exposure of Resource to Wrong Sphere (The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.).
How can I check Go dependencies for CVE-2026-42875?
Run the dependency tree command: 'inspect dependencies for github.com/external-secrets/external-secrets'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wv26-88m5-6h59",
  "modified" : "2026-05-13T14:18:52Z",
  "published" : "2026-05-05T18:37:12Z",
  "aliases" : [ "CVE-2026-42875" ],
  "summary" : "External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore",
  "details" : "### Impact\n\nNamespaced SecretStore resources that used CAProvider with type `ConfigMap` could resolve CA material from another namespace when `caProvider.namespace` was set. \nThis bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. \n\nThe accessible data is used as CA validation material, hence it is not directly exposed.\n\nImpact:\n- Direct data exfiltration risk: low\n- Existence disclosure: an attacker can infer whether a target ConfigMap/key exists in another namespace.\n- Trust-boundary violation: a tenant can make its SecretStore consume CA material owned by another namespace.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/external-secrets/external-secrets"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.4.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-wv26-88m5-6h59"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42875"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/external-secrets/external-secrets"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285", "CWE-668" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-05T18:37:12Z",
    "nvd_published_at" : "2026-05-11T20:25:44Z"
  }
}