{"id":"EUVD-2026-29191","revision":"97973e7312d64978b5df40e41db08bf3","records":[{"revision":"97973e7312d64978b5df40e41db08bf3","observedAt":"2026-11-07T09:36:11.31+00:00","statement":{"source":"euvd","id":"EUVD-2026-29191","aliases":["CVE-2026-42876","GHSA-fq7h-9x26-6j22"],"title":"External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to c…","description":"External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","score":4.9,"severity":null}],"references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fq7h-9x26-6j22","https://github.com/external-secrets/external-secrets/commit/4ddd240af7fe88725d9857b9a0c198073502e288","https://github.com/external-secrets/external-secrets/releases/tag/v2.4.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29191","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 11, 2026, 6:58:44 PM","dateUpdated":"Oct 6, 2026, 3:30:23 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29191","identifiers":["EUVD-2026-29191","CVE-2026-42876","GHSA-fq7h-9x26-6j22"]},"retained":false,"historicalAffected":[]}],"coverage":[]}