Improper Access Control Affecting external-secrets-operator package, versions <0.19.2-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-EXTERNALSECRETSOPERATOR-13315079
- published6 Oct 2025
- disclosed13 Aug 2025
Introduced: 13 Aug 2025
CVE-2025-55196 (opens in a new tab)How to fix?
Upgrade Minimos:latest external-secrets-operator to version 0.19.2-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream external-secrets-operator package and not the external-secrets-operator package as distributed by Minimos.
See How to fix? for Minimos:latest relevant fixed versions and status.
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.
References
- https://www.cve.org/CVERecord?id=CVE-2025-55196
- https://github.com/advisories/GHSA-fcxq-v2r3-cc8h
- https://osv.dev/vulnerability/MINI-q28f-6gqv-jjrj
- https://osv.dev/vulnerability/CVE-2025-55196
- https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d
- https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1
- https://github.com/external-secrets/external-secrets/pull/5109
- https://github.com/external-secrets/external-secrets/pull/5133
- https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h