{"id":"CVE-2026-26287","kind":"vulnerability","aliases":["CVE-2026-26287","GHSA-q7hv-xx6h-q2x8","GO-2026-6667"],"related":[],"title":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets","description":"External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.","summary":"External Secrets Operator's webhook generator cleared its label-enforcement flag during initialization, so the check requiring the external-secrets.io/type=webhook label was skipped. A user who can create or reference generator resources can therefore get secrets exfiltrated through the webhook path that should have been refused.","severity":"high","cvss":7.1,"epss":0.00244,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/external-secrets/external-secrets","fixed":["1.3.2"],"affected":">= 0.10.0, < 1.3.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["external-secrets","go","kubernetes","package","self-hosted"],"not_affected_if":["version-1.3.2-or-later","webhook-generator-unused"],"how_to_check":"Run go list -m github.com/external-secrets/external-secrets in the module, or check the deployed controller image version with kubectl get deploy -A -o wide | grep external-secrets.","fix":"Upgrade to external-secrets 1.3.2 or later.\nRotate any secrets fetched through the webhook generator if exposure is suspected.","status":"open","published_at":"2026-10-06T16:17:07+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:21+00:00","updated_at":"2026-10-23T19:56:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:56:21Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to external-secrets 1.3.2 or later.\nRotate any secrets fetched through the webhook generator if exposure is suspected.","summary":"External Secrets Operator's webhook generator cleared its label-enforcement flag during initialization, so the check requiring the external-secrets.io/type=webhook label was skipped. A user who can create or reference generator resources can therefore get secrets exfiltrated through the webhook path that should have been refused.","category":"package","who_cares":["kubernetes","external-secrets","go","self-hosted"],"confidence":0.8,"analyst_note":"Confirm from the GHSA-q7hv-xx6h-q2x8 advisory whether the attacker needs prior RBAC or namespace access to exploit it, which would change the real risk.","how_to_check":"Run go list -m github.com/external-secrets/external-secrets in the module, or check the deployed controller image version with kubectl get deploy -A -o wide | grep external-secrets.\nUnknown whether any config or log line reveals exploitation.","needs_analyst":true,"not_affected_if":["version-1.3.2-or-later","webhook-generator-unused"],"severity_if_unknown":"unknown"},"cost_usd":0.000436,"input_tokens":2281,"output_tokens":415,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A,29A '-26287':19A,30A '-6667':27A '/external-secrets/external-secrets':16A,33A '/type:':171C '/type=webhook':64B,149C '0.10.0':113C '1.3.2':118C,182C 'automat':103C 'bug':120C 'bypass':6A 'check':59B,145C 'clear':49B,128C 'contain':166C,183C 'creat':72B 'cve':17A,28A 'enabl':10A 'enforc':5A,53B,132C 'enforcelabel':134C 'exfiltr':12A,81B 'extern':1A,35B,43B,91C 'external-secret':34B 'external-secrets.io':63B,148C,170C 'external-secrets.io/type:':169C 'external-secrets.io/type=webhook':62B,147C 'fail':161C 'flag':54B,133C 'generat':9A,48B,75B,124C 'get':79B 'ghsa':21A 'ghsa-q7hv-xx6h-q2x8':20A 'github.com':15A,32A 'github.com/external-secrets/external-secrets':14A,31A 'go':25A,37B 'host':42B 'incorrect':127C 'inform':95C 'initi':56B,125C 'inject':104C 'kubernet':38B,108C 'label':4A,52B,65B,131C,168C,175C 'label-enforc':51B,130C 'need':167C 'oper':3A,45B,93C,154C 'order':126C 'packag':39B 'parti':100C 'patch':185C 'path':85B 'prior':115C 'provid':143C 'provider-sid':142C 'q2x8':24A 'q7hv':22A 'read':94C 'refer':74B 'refus':90B 'requir':60B 'resourc':76B 'result':139C 'secret':2A,11A,36B,44B,80B,92C,109C,163C,174C 'self':41B 'self-host':40B 'servic':101C 'set':138C 'side':144C 'skip':67B,151C 'start':110C 'succeed':156C 'therefor':78B 'third':99C 'third-parti':98C 'updat':173C 'use':177C 'user':69B 'valu':106C 'version':112C,117C,181C 'webhook':8A,47B,84B,123C,172C,180C 'xx6h':23A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-06T16:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6667","url":"https://pkg.go.dev/vuln/GO-2026-6667","severity":null,"published_at":"2026-10-20T00:20:51+00:00","modified_at":"2026-10-20T00:20:51+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-26287","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-26287","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-26287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26287","severity":null,"published_at":"2026-10-06T16:17:07+00:00","modified_at":"2026-10-06T20:03:40+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}