{"id":"GO-2026-6667","summary":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets","details":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets","aliases":["CVE-2026-26287","GHSA-q7hv-xx6h-q2x8"],"modified":"2026-10-20T00:45:10.097500666Z","published":"2026-10-20T00:20:51Z","database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6667"},"references":[{"type":"ADVISORY","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8"},{"type":"FIX","url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba"},{"type":"FIX","url":"https://github.com/external-secrets/external-secrets/pull/5901"},{"type":"WEB","url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2"}],"affected":[{"package":{"name":"github.com/external-secrets/external-secrets","ecosystem":"Go","purl":"pkg:golang/github.com/external-secrets/external-secrets"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.3.2"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6667.json"}}],"schema_version":"1.9.0"}