4.9

CVE-2026-22728: sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Deferred
AliasesCGA-3vxw-xv82-fj5qGHSA-465p-v42x-3fmjBIT-sealed-secrets-2026-22728
Published 26-02-2026Last modified 26-02-2026

Vulnerability summary

CVE-2026-22728 is a medium (CVSS 4.9) Improper Access Control vulnerability in bitnami sealed-secrets. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 4.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.41%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:21483-1SUSE-SU-2026:1042-1CGA-4JV9-3XGW-GGFC

Timeline

  1. 26-02-2026
    PublishedVulnerability first disclosed.
  2. 26-02-2026
    Last modifiedVulnerability information updated.

Description

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original "strict" or "namespace-wide" constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 0.36% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Bitnami1 product
Chainguard1 product
  • kots< 1.129.4-r2
Github.com/bitnami-labs1 product
  • sealed-secrets< 0.36.0
Wolfi1 product
  • kots< 1.129.4-r2

4 vendors · 4 products

References

6 links