CVE-2026-59341: Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints
A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full plaintext of any sealed secret.
The POST /v1/verify and /v1/rotate handlers call Unseal() to decrypt target secrets, then render any Go templates found in spec.template.data. using the decrypted payload as the evaluation context (pkg/apis/sealedsecrets/v1alpha1/sealedsecretexpansion.go). Errors encountered during template execution are directly reflected in the resulting HTTP response status codes.
Missing AEAD label binding: the spec.template.data field is omitted from the AEAD authenticated-data label binding ciphertext to metadata. As a result, an attacker can copy a target's valid metadata and encryptedData verbatim, satisfying AEAD decryption and label validation, while freely replacing spec.template.data with arbitrary template logic.
Side-channel oracle: template execution errors map directly to HTTP response codes. HTTP 200 (OK) indicates template execution succeeded; HTTP 409 (Conflict) indicates template execution failed (e.g. via {{ fail "..." }}).
By injecting conditional statements such as {{ if eq (substr 0 1 .password) "S" }}ok{{ else }}{{ fail "x" }}{{ end }}, an attacker receives an HTTP 200 status when a character guess is correct and an HTTP 409 when it is incorrect. This differential response leaks one character-equality bit per request, allowing full secret extraction over successive queries.
Attack vector & prerequisites: unauthenticated; requires network access to the controller's internal service port (:8080). Although this service is not exposed to the public internet by default, it is accessible to any pod within the Kubernetes cluster or via a kubectl port-forward connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the Sealed Secrets controller’s internal service port (:8080) is not reachable from arbitrary pods in the Kubernetes cluster or from unauthenticated network paths; allow access only from the intended controller clients (and/or restrict via Kubernetes NetworkPolicies / service-to-service allowlisting).
Sealed Secrets controller (unauthenticated POST endpoints) Access control to controller internal service port (:8080) = Restrict to trusted identities/pods only - Compensating control
If kubectl port-forward is not required, prevent/limit its use to authorized administrators only; otherwise treat it as an access path to the controller and restrict who can establish port-forward sessions to the Sealed Secrets service.
Event History
Frequently Asked Questions
What access and material does an attacker need to exploit this issue?
The attacker needs internal network access to reach the controller's unauthenticated POST endpoints. They also need a target sealed secret's valid metadata and encryptedData, which can be copied unchanged while replacing spec.template.data.
Which endpoints are involved?
The affected handlers are POST /v1/verify and POST /v1/rotate. These handlers invoke decryption and then render Go templates supplied in spec.template.data.
What observable behavior enables the oracle?
Template execution errors are reflected through HTTP response status codes. An HTTP 200 response indicates that template execution succeeded, allowing an attacker to use response behavior when testing template logic.