Homepage

Incorrect Behavior Order Affecting external-secrets-operator package, versions <1.3.2-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.24% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-EXTERNALSECRETSOPERATOR-20564207
  • published8 Oct 2026
  • disclosed6 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2026

NewCVE-2026-26287  (opens in a new tab)
CWE-696  (opens in a new tab)

How to fix?

Upgrade Minimos:latest external-secrets-operator to version 1.3.2-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream external-secrets-operator package and not the external-secrets-operator package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag (EnforceLabels) after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped (and the operation to succeed while it should have failed with secret does not contain needed label &#39;external-secrets.io/type: webhook&#39;. Update secret label to use it with webhook. Version 1.3.2 contains a patch.