CVE-2026-42875

Name of the Vulnerable Software and Affected Versions External Secrets Operator versions prior to 2.4.0

Description Namespaced SecretStore resources using CAProvider with type ConfigMap could resolve CA material from a different namespace when the caProvider.namespace variable was set. This behavior bypassed the namespace boundary enforced for SecretStore-backed references in providers relying on the shared runtime CA resolver. While the accessible data is used for CA validation and not directly exposed, this leads to a trust-boundary violation where a tenant can force its SecretStore to consume CA material owned by another namespace. Additionally, it allows for existence disclosure, enabling an attacker to infer if a specific target ConfigMap or key exists in another namespace.

Recommendations Update to version 2.4.0.