CVE-2026-8715

Name of the Vulnerable Software and Affected Versions Vault Secrets Operator versions 1.3.0 through 1.4.1

Description An arbitrary file read and credential exfiltration issue exists in the AppRole authentication configuration. This allows a tenant with limited Kubernetes RBAC (Role-Based Access Control, a method of regulating access to computer or network resources based on the roles of individual users) permissions to read files from the operator pod's filesystem and transmit the contents to a tenant-controlled endpoint, which could lead to privilege escalation within the cluster.

Recommendations Update Vault Secrets Operator to version 1.5.0.