« Volver al listado

CVE-2025-55196

Estado: AplazadaAlta (7.1)—

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions.

Leer descripción completaMostrar menos

An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso de red con PR:L permite listar secretos entre namespaces sin autorización. Divulgación de credenciales, tokens y datos sensibles en Kubernetes.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationVulnerability ScanningUser Account ManagementThreat Intelligence ProgramLimit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

External-secrets — External Secrets OperatorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-55196",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-55196",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-14T13:41:41.648785Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "external-secrets",
          "product": "external-secrets",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.15.0, < 0.19.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-13T23:15:27.500",
  "references": [
    {
      "url": "https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/external-secrets/external-secrets/pull/5109",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/external-secrets/external-secrets/pull/5133",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources."
    },
    {
      "lang": "es",
      "value": "External Secrets Operator de Kubernetes que integra sistemas externos de gestión de secretos. Desde la versión 0.15.0 hasta la 0.19.2, se descubrió una vulnerabilidad en la que las llamadas List() para los recursos Secret y SecretStore de Kubernetes, realizadas por el controlador PushSecret, no aplicaban un selector de espacio de nombres. Esta falla permitía a un atacante usar selectores de etiquetas para listar y leer secretos y almacenes de secretos en el clúster, eludiendo las restricciones de espacio de nombres previstas. Un atacante con la capacidad de crear o actualizar recursos PushSecret y controlar las configuraciones de SecretStore podría explotar esta vulnerabilidad para extraer datos confidenciales de espacios de nombres arbitrarios. Esto podría provocar la divulgación completa de secretos de Kubernetes, incluyendo credenciales, tokens y otra información confidencial almacenada en el clúster. Esta vulnerabilidad se ha corregido en la versión 0.19.2. Una solución alternativa para este problema incluye auditar y restringir los permisos RBAC para que solo las cuentas de servicio de confianza puedan crear o actualizar recursos PushSecret y SecretStore."
    }
  ],
  "lastModified": "2026-06-17T09:41:26.290",
  "sourceIdentifier": "security-advisories@github.com"
}