REDHAT-BUG-2431873: High severity External Secrets Operator vulnerability
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of getSecretKey in any ExternalSecret resource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.2.0 - Compensating control
Use a policy engine (Kubernetes, Kyverno, Kubewarden, or OPA) to prevent the usage of the `getSecretKey` template function in any ExternalSecret resource (for versions starting in 0.20.2 and prior to 1.2.0).
Event History
Frequently Asked Questions
Which deployments are affected?
External Secrets Operator deployments starting with version 0.20.2 and before version 1.2.0 are affected if ExternalSecret resources use the getSecretKey template function.
What access does an attacker need to exploit this issue?
The issue relies on use of getSecretKey in an ExternalSecret resource. That function can fetch secrets across namespaces using the external-secrets controller's RoleBinding, bypassing the operator's security mechanisms.
What can be done if upgrading is not immediately possible?
Use a policy engine to prevent getSecretKey from being used in any ExternalSecret resource. The provided workaround names Kubernetes, Kyverno, Kubewarden, and OPA as policy-engine options.
How is the issue addressed in newer releases?
The getSecretKey template function was completely removed in version 1.2.0. Its functionality can be implemented differently while respecting External Secrets Operator safeguards.