Bitnami Sealed Secrets allows secret rotation through the /v1/rotate endpoint. The rotation logic incorrectly derives the sealing scope from untrusted template annotations in the submitted SealedSecret. If an attacker injects the annotation sealedsecrets.bitnami.com/cluster-wide=true, the rotated secret becomes cluster‑wide, bypassing namespace restrictions. This permits the attacker to unseal or retrieve the plaintext credentials in any namespace or for any name, resulting in confidential data exposure.

The vulnerability affects the Bitnami Sealed Secrets component used in Kubernetes clusters. All versions that expose the /v1/rotate API are impacted; no specific version range was provided in the advisory.

The CVSS score is 4.9, indicating moderate risk, and the EPSS probability is less than 1%, suggesting low exploitation likelihood. The security community has not listed this issue in the CISA KEV catalog. Exploitation requires the ability to submit a SealedSecret to the rotation endpoint, which is typically controlled by users with create permissions in a namespace. A malicious user able to do so can craft a SealedSecret containing the cluster‑wide annotation, obtain a rotated cluster‑wide secret, and unseal it elsewhere to recover sensitive data.