External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration (CVE-2026-26287)

CVE-2026-26287 is a vulnerability in github.com/external-secrets/external-secrets affecting versions >=0.10.0 <1.3.2. The flaw arises from an incorrect initialization order in the webhook generator that clears the label-enforcement flag (EnforceLabels) after it is set. This causes the provider-side check for the label 'external-secrets.io/type=webhook' to be skipped, allowing operations that should fail due to missing labels to succeed. Consequently, a user with permission to create webhook generators can target secrets not labeled for webhook use and exfiltrate their contents to a malicious URL. The CVSS 3.1 score is 7.1 (High), reflecting network attack vector, low complexity, required privileges, no user interaction, and high confidentiality impact with limited integrity impact. A patch is available to correct the initialization order and enforce label checks properly.

The vulnerability allows an attacker with permission to create webhook generators to bypass label enforcement and exfiltrate secrets that were not intended for webhook access. This leads to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity impact is limited, and availability is not affected. There are no known exploits in the wild at this time.

A patch is available for this vulnerability; upgrading to version 1.3.2 or later is recommended. Until patched, risk can be reduced by disabling webhook generators if not needed, restricting RBAC permissions to limit who can create webhook generators, enforcing admission policies (e.g., OPA Gatekeeper or Kyverno) that require secrets to have the 'external-secrets.io/type=webhook' label, and restricting egress network access from external-secrets controller pods via Kubernetes NetworkPolicy or service mesh egress policies.