External Secrets Operator allows an attacker to retrieve Kubernetes secrets from any namespace by leveraging the getSecretKey templating function. This function was intended for use with the senhasegura Devops Secrets Management provider but can also be abused to access secrets outside the authorized namespace. The vulnerability stems from a missing access control check (CWE‑863) and permits the execution of arbitrary secret retrieval across namespaces, resulting in a breach of confidentiality for secrets that should be isolated within their own namespace.

The affected vendor is external‑secrets, and the product is the External Secrets Operator. Versions 0.20.2 through 1.1.x are vulnerable; the function was removed in version 1.2.0, so any deployment running a version prior to that release is impacted. No other vendors or products are mentioned in the CNA list.

The CVSS score of 9.3 indicates a high severity level, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector for exploitation is an internal attacker or a compromised component that can create or modify ExternalSecret resources; by embedding getSecretKey calls, the attacker can read secrets from namespaces they should not access. Mitigation requires local changes rather than external network exposure, so the threat is contained within the cluster environment.