The vulnerability is caused by a remnant getHostByName function in the External Secrets Operator’s v2 template engine. Templates that administrators or authorized users create are executed inside the controller process, giving any attacker who can add or modify a templated ExternalSecret the ability to trigger DNS lookups. The attacker can embed secret‑derived data into the lookup target, causing the controller to query an external DNS server and thereby exfiltrate sensitive secret material. The core weakness aligns with the confidentiality category of this CVE and is identified as CWE‑200 and CWE‑94; the CVE record also lists NVD‑CWE‑noinfo, indicating no additional standard CWE classification.

The issue affects the External Secrets Operator, specifically the external‑secrets:external‑secrets product. All releases up to and including 2.2.0 are vulnerable; the problem was resolved in version 2.3.0. Further version details are not provided beyond this upgrade point.

With a CVSS score of 7.1, the risk is considered moderate to high. The EPSS score of 0.00044 indicates a very low, but non‑zero, probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. If the attacker has permission to create or update templated ExternalSecret objects, DNS exfiltration can occur even when the attacker’s workload lacks outbound network connectivity, marking it a significant confidentiality threat in environments with less trusted users or unrestricted templated secret creation.