The vulnerability arises from the ECK operator reading secret references from annotations and accepting the namespace specified without validating authority; a user with limited namespace permissions can write an annotation, trigger reconciliation, and have the operator copy secrets from any namespace into a user‑accessible secret, thereby exposing sensitive data beyond the intended scope.

Elastic Cloud on Kubernetes (ECK) operator – any deployment that has not applied the released security update. The issue is pertinent when users have write access to apply annotations on secrets within their own namespace, even if they lack cluster‑wide read rights.

The CVSS score of 6.5 indicates a moderate vulnerability; the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a Kubernetes cluster where the attacker can create or modify secrets; they do not need cluster‑admin privileges, only the ability to write annotations on secrets in their namespace. Once an annotation is written, the operator’s cluster‑level secret permissions are leveraged by the reconcile loop to copy data from arbitrary namespaces, resulting in a confidentiality breach.