Upstream information

CVE-2025-55196 at MITRE

Description

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having not set severity.

CVSS v4 Scores
CVSS detail CNA (GitHub)
Base Score 7.1
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required Low
User Interaction None
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
Container bci/bci-base:16.0
Container elemental/base-os-kernel-default:16.0
Container elemental/base-os-kernel-rt:16.0
Container suse/git:latest
  • libudev1 >= 257.10-160000.1.1
Container bci/bci-init:16.0-10.12
  • libsystemd0 >= 257.10-160000.1.1
  • systemd >= 257.10-160000.1.1
Container bci/gcc:15
Container bci/node:24
Container bci/node:24-micro
Container suse/389-ds:latest
Container suse/valkey:latest
  • libsystemd0 >= 257.10-160000.1.1
Container bci/kiwi:10
Container elemental/elemental-lifecycle-manager:latest
Container suse/pcp:latest
Container third-party/nvidia/driver:595-sles16.0
Container third-party/nvidia/driver:595.45.04-sles16.0
Container third-party/nvidia/driver:595.58.03-sles16.0
Container third-party/nvidia/driver:610-sles16.0
Container third-party/nvidia/driver:615-sles16.0
  • libsystemd0 >= 257.10-160000.1.1
  • libudev1 >= 257.10-160000.1.1
  • systemd >= 257.10-160000.1.1
Container elemental/elemental:3.0
Container rancher/seedimage-builder:latest
Container suse/sles/16.0/containerdisk-minimal:latest
Image 16_0
Image SLES-Azure-3P
Image SLES-Azure-Basic
Image SLES-Azure-Standard
Image SLES-BYOS-Azure
Image SLES-BYOS-EC2
Image SLES-BYOS-GCE
Image SLES-CHOST-BYOS-Aliyun
Image SLES-CHOST-BYOS-Azure
Image SLES-CHOST-BYOS-EC2
Image SLES-CHOST-BYOS-GCE
Image SLES-CHOST-BYOS-GDC
Image SLES-CHOST-BYOS-SAP-CCloud
Image SLES-EC2
Image SLES-EC2-ECS
Image SLES-GCE
Image SLES-GCE-3P
Image SLES-Hardened-BYOS-Azure
Image SLES-Hardened-BYOS-EC2
Image SLES-Hardened-BYOS-GCE
Image SLES-SAP-Azure
Image SLES-SAP-Azure-3P
Image SLES-SAP-BYOS-Azure
Image SLES-SAP-BYOS-EC2
Image SLES-SAP-BYOS-GCE
Image SLES-SAP-EC2
Image SLES-SAP-GCE
Image SLES-SAP-GCE-3P
Image SLES-SAPCAL-Azure
Image SLES-SAPCAL-EC2
Image SLES-SAPCAL-GCE
Image kiwi-templates-Minimal
Image kiwi-templates-Minimal-Cloud
Image kiwi-templates-Minimal-Cloud-sap
Image kiwi-templates-Minimal-MS-HyperV
Image kiwi-templates-Minimal-MS-HyperV-sap
Image kiwi-templates-Minimal-kvm-and-xen
Image kiwi-templates-Minimal-kvm-and-xen-encrypt
Image kiwi-templates-Minimal-kvm-and-xen-sap
  • libsystemd0 >= 257.10-160000.1.1
  • libudev1 >= 257.10-160000.1.1
  • systemd >= 257.10-160000.1.1
  • udev >= 257.10-160000.1.1
Container suse/sles/16.0/toolbox:latest
  • libsystemd0 >= 257.10-160000.1.1
  • libudev1 >= 257.10-160000.1.1
Image SLE-Micro-Azure
Image SLE-Micro-BYOS-Azure
  • cloud-netconfig-azure >= 1.18-slfo.1.1_1.1
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-GCE
  • cloud-netconfig-gce >= 1.18-slfo.1.1_1.1
Image SLE-Micro
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-EC2
  • cloud-netconfig-ec2 >= 1.18-slfo.1.1_1.1
SUSE Linux Enterprise Server 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20250818T190335-1.1
 Patchnames:
openSUSE-Tumbleweed-2025-15469

SUSE Timeline for this CVE

CVE page created: Thu Aug 14 02:00:53 2025
CVE page last modified: Thu Nov 5 14:31:15 2026