External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.
The templating function `getSecretKey`, originally introduced for the senhasegura Devops Secrets Management (DSM) provider, uses the permissions (roleBinding) of the external-secrets controller. This allows a local user with rights to create or modify ExternalSecret resources to use this function to retrieve secrets from namespaces other than their own. The mechanism bypasses the operator's built-in security features, which normally restrict access to secrets only within the same namespace. In version 1.2.0, the `getSecretKey` function was completely removed.
An attacker with local privileged access (PR:L) to a Kubernetes cluster can read and indirectly expose or modify confidential secrets (e.g., passwords, tokens, API keys) belonging to other teams or applications running in separate namespaces, which may lead to compromise of the entire cluster.
Update External Secrets Operator to version 1.2.0 or later, in which the `getSecretKey` function has been completely removed. As a workaround for earlier versions, it is recommended to implement a policy engine (e.g., Kyverno, Kubewarden, OPA, or native Kubernetes policies) that blocks the use of the `getSecretKey` function in ExternalSecret resources.
External Secrets Operator in versions from 0.20.2 (inclusive) to 1.2.0 (exclusive)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XExternal Secrets Operator
APPExternal-Secrets0.20.2 – 1.2.0 (excl.)
Related vulnerabilities
Nieprawidłowe uprawnienia w External Secrets Operator umożliwiają privilege escalation
External Secrets Operator reads information from a third-party service and automatically injects the values as...
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The ext...