The External Secrets Operator automatically injects secrets into a cluster, and before version 2.4.1 a user with only the ability to create ExternalSecret resources could trigger the operator to create a Kubernetes Secret that contains a long‑lived token for any service account within the namespace. This bypasses normal token‑request permissions and allows the attacker to impersonate any service account, effectively escalating privileges. The weakness is an access‑control flaw identified as CWE‑285.

The vulnerability afflicts the External Secrets Operator supplied by the external‑secrets project. All releases older than 2.4.1 are vulnerable; this includes any deployment of the operator in a Kubernetes cluster where users may create ExternalSecret objects in the namespace. The operator is typically installed in namespaces where the RBAC policy might allow ExternalSecret creation, so any such namespace is at risk.

The CVSS score of 4.9 reflects medium severity. No EPSS score is reported and the issue is not cataloged in CISA KEV. Based on the description, it is inferred that the attack vector is internal, contingent on the attacker having permission to create an ExternalSecret resource. Once that resource is created, the operator automatically generates a token for the chosen service account, enabling the attacker to impersonate that account and act with its permissions.