CVE-2026-42875: external-secrets Improper Authorization

Vulnerability summary

CVE-2026-42875 is a medium (CVSS 5.3) Improper Authorization vulnerability in external-secrets. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.9% of scored vulnerabilities.

Timeline

1. 11-05-2026
   PublishedVulnerability first disclosed.
2. 12-05-2026
   Last modifiedVulnerability information updated.

Description

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. This vulnerability is fixed in 2.4.0.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.