External Secrets Operator reads data from a third‑party service and injects it as Kubernetes Secrets. In versions 0.10.0 through 1.3.1 the webhook generator incorrectly reset the `EnforceLabels` flag after it was set, allowing the provider‑side check for the required label `external-secrets.io/type=webhook` to be skipped. As a result the operator would succeed in creating secrets that lack the mandatory label, enabling an attacker to inject arbitrary secrets or exfiltrate sensitive credentials that should otherwise have been blocked.

The vulnerability affects the External Secrets Operator (external‑secrets:external‑secrets) in all releases from 0.10.0 up to, but not including, 1.3.2. The issue resides in the webhook generator component of the operator itself.

The vulnerability carries a CVSS score of 7.1, indicating a high impact potential. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with control over the webhook provider that can force the operator to inject secrets; the attacker would need sufficient cluster permissions to create Kubernetes Secrets. The risk assessment is moderate to high due to the bypass of label enforcement and the possibility of leaking privileged information through injected secrets.