Описание
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. This vulnerability is fixed in 2.4.0.
A flaw was found in External Secrets Operator. Namespaced SecretStore resources configured with CAProvider of type ConfigMap, when caProvider.namespace is set, could resolve Certificate Authority (CA) material from other namespaces. This bypasses the intended namespace boundary, potentially allowing an attacker to gain unauthorized access to sensitive CA material.
Отчет
Red Hat rates this flaw as Moderate. The exposed data is limited to CA certificate material, which is public-key content used for TLS validation, not secrets or credentials. An attacker cannot leverage this to access the actual secrets stored in the external backend. Exploitation requires permissions to create or modify SecretStore resources within the cluster, limiting the attacker pool to authenticated users with specific RBAC grants.
Меры по смягчению последствий
Do not set the caProvider.namespace field on namespaced SecretStore resources. When this field is omitted, the operator resolves CA material only from the local namespace, preventing the cross-namespace bypass. Review existing SecretStore configurations and remove any caProvider.namespace references that are not strictly required.
Дополнительная информация
Статус:
EPSS
6.4 Medium
CVSS3
Связанные уязвимости
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. This vulnerability is fixed in 2.4.0.
External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
EPSS
6.4 Medium
CVSS3