Medium, CVSS 4.9GoPublished
Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations
CVE-2026-22728 · GHSA-465p-v42x-3fmj
- Affected
- Go github.com/bitnami-labs/sealed-secrets < 0.36.0
- Fixed in
- 0.36.0· Vendor fix available
- Issue
- This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted spec.template.metadata.annotations on the input sealed secret. If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set sealedsecrets.bitnami.com/cluster-wide=true in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (metadata.name/metadata.namespace) and unsealing to recover the victim plaintext. Relevant Links (Pinned) - Rotate handler uses NewSealedSecret(..., secret) after unsealing: https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/controller/controller.go#L560-L606 - Scope derivation reads secret annotations (SecretScope): https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/apis/sealedsecrets/v1alpha1/sealedsecretexpansion.go#L112-L122 Root Cause The rotate…
Recommended action: Upgrade to 0.36.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.