CVE-2026-8715: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vault Secrets Operatorto a version that resolves this vulnerability.Fixed in 1.5.0 - Compensating control
Mitigate the arbitrary file read/credential exfiltration risk by preventing tenant-controlled network access from the operator pod (e.g., restrict egress so AppRole-triggered exfiltration to tenant-controlled endpoints is blocked).
- Operational
If AppRole secretIDPath/sectIDPath may have exposed operator service account credentials to a tenant, rotate/revoke any affected credentials (including the operator ServiceAccount token) after upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8715?
CVE-2026-8715 has a critical severity rating of 9.6.
How do I fix CVE-2026-8715?
To remediate CVE-2026-8715, upgrade Vault Secrets Operator to version 1.4.2 or later.
What systems are affected by CVE-2026-8715?
CVE-2026-8715 affects Vault Secrets Operator versions 1.3.0 to 1.4.1.
What type of vulnerability is CVE-2026-8715?
CVE-2026-8715 is an arbitrary file read and credential exfiltration vulnerability.
Can CVE-2026-8715 be exploited by users with limited permissions?
Yes, CVE-2026-8715 can be exploited by tenants with limited Kubernetes RBAC permissions.