Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://gist.github.com/HouqiyuA/a4834f3c8450f9d89e2bc4d5c4beef6a | Third Party Advisory |
| https://gist.github.com/HouqiyuA/a4834f3c8450f9d89e2bc4d5c4beef6a | Third Party Advisory |
Configurations
History
27 Jun 2025, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/HouqiyuA/a4834f3c8450f9d89e2bc4d5c4beef6a - Third Party Advisory | |
| CPE | cpe:2.3:a:external-secrets:external_secrets_operator:0.9.16:*:*:*:*:*:*:* | |
| First Time |
External-secrets
External-secrets external Secrets Operator |
24 Jul 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-24 17:15
Updated : 2025-06-27 16:50
NVD link : CVE-2024-36540
Mitre link : CVE-2024-36540
JSON object : View
Products Affected
external-secrets
- external_secrets_operator
CWE
No CWE.