{"id":"GO-2026-6667","revision":"9e7a245affb3454eb0f809e77d77cc3b","records":[{"revision":"9e7a245affb3454eb0f809e77d77cc3b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6667","aliases":["CVE-2026-26287","GHSA-q7hv-xx6h-q2x8"],"title":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets","description":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets","state":0,"publishedAt":"2026-10-20T00:20:51+00:00","modifiedAt":"2026-10-20T00:45:10.0975007+00:00","affected":[{"ecosystem":"Go","name":"github.com/external-secrets/external-secrets","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.10.0"},{"kind":"fixed","version":"1.3.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8","https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba","https://github.com/external-secrets/external-secrets/pull/5901","https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6667","license":"OSV · upstream source license applies","key":"osv:GO-2026-6667","identifiers":["GO-2026-6667","CVE-2026-26287","GHSA-q7hv-xx6h-q2x8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}