Answer in brief
CVE-2026-42875 records a Unknown severity vulnerability in External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore. The current sources do not mark it as known exploited. The current feed maps github.com/external-secrets/external-secrets (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/external-secrets/external-secrets (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/external-secrets/external-secretsgo | >=0 <2.4.0 | 2.4.0 |
Published upstream
May 5, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
### Impact Namespaced SecretStore resources that used CAProvider with type `ConfigMap` could resolve CA material from another namespace when `caProvider.namespace` was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver. The accessible data is used as CA validation material, hence it is not directly exposed. Impact: - Direct data exfiltration risk: low - Existence disclosure: an attacker can infer whether a target ConfigMap/key exists in another namespace. - Trust-boundary violation: a tenant can make its SecretStore consume CA material owned by another namespace.
Quoted source text, attributed separately from HOL analysis.