GO-2026-4330
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/external-secrets/external-secrets | 0.20.2 | 1.2.0 |
| go | github.com/external-secrets/external-secrets | 0.20.2 | 1.2.0 |