{"id":"EUVD-2026-93468","enisaUuid":"426626ce-872c-38ce-b9ce-472fa1b7869f","description":"External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type\u003dwebhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label \u0027external-secrets.io/type: webhook\u0027. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.","datePublished":"Oct 6, 2026, 3:31:56 PM","dateUpdated":"Oct 6, 2026, 5:21:44 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8\nhttps://github.com/external-secrets/external-secrets/pull/5901\nhttps://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba\nhttps://github.com/external-secrets/external-secrets/releases/tag/v1.3.2\n","aliases":"CVE-2026-26287\nGHSA-q7hv-xx6h-q2x8\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"3b0e8c2c-c535-31cc-9831-e9a02b38def4","product":{"name":"external-secrets","vendor":{"name":"external-secrets"}},"product_version":"0.10.0, \u003c 1.3.2"}],"enisaIdVendor":[{"id":"a345049e-3450-38af-b4ad-912594d0844c","vendor":{"name":"external-secrets"}}],"enisaIdVulnerability":[{"id":"3a1931cd-a359-379d-9f88-1fd04fc236eb","vulnerability":{"id":"CVE-2026-26287","description":"External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type\u003dwebhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label \u0027external-secrets.io/type: webhook\u0027. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.","datePublished":"Oct 6, 2026, 3:31:56 PM","dateUpdated":"Oct 6, 2026, 5:21:44 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8\nhttps://github.com/external-secrets/external-secrets/pull/5901\nhttps://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba\nhttps://github.com/external-secrets/external-secrets/releases/tag/v1.3.2\n","enisa_id":"EUVD-2026-93468\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 7, 2026, 7:23:43 AM","vulnerabilityProduct":[{"id":"e471350a-4923-32c7-8a70-c6b2f6324be0","product":{"name":"external-secrets","vendor":{"name":"external-secrets"}},"product_version":"0.10.0, \u003c 1.3.2"}],"vulnerabilityVendor":[{"id":"31f5aba9-b5a4-3e28-82e0-6ad773e7698b","vendor":{"name":"external-secrets"}}]}},{"id":"a0ce3eb2-5a8e-3a98-bf27-883a7b78cf1a","vulnerability":{"id":"GHSA-q7hv-xx6h-q2x8","description":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration","datePublished":"Oct 6, 2026, 3:29:25 PM","dateUpdated":"Oct 6, 2026, 3:29:25 PM","baseScore":0.0,"references":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8\nhttps://github.com/external-secrets/external-secrets/pull/5901\nhttps://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba\nhttps://github.com/external-secrets/external-secrets\nhttps://github.com/external-secrets/external-secrets/releases/tag/v1.3.2\n","enisa_id":"EUVD-2026-93468\n","aliases":"GHSA-q7hv-xx6h-q2x8\nCVE-2026-26287\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}