CVE-2026-42875
Description
A flaw was found in External Secrets Operator. Namespaced SecretStore resources configured with CAProvider of type ConfigMap, when caProvider.namespace is set, could resolve Certificate Authority (CA) material from other namespaces. This bypasses the intended namespace boundary, potentially allowing an attacker to gain unauthorized access to sensitive CA material.
Statement
Red Hat rates this flaw as Moderate. The exposed data is limited to CA certificate material, which is public-key content used for TLS validation, not secrets or credentials. An attacker cannot leverage this to access the actual secrets stored in the external backend. Exploitation requires permissions to create or modify SecretStore resources within the cluster, limiting the attacker pool to authenticated users with specific RBAC grants.
Mitigation
Do not set the caProvider.namespace field on namespaced SecretStore resources. When this field is omitted, the operator resolves CA material only from the local namespace, preventing the cross-namespace bypass. Review existing SecretStore configurations and remove any caProvider.namespace references that are not strictly required.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
