https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:52:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-271170 EUVD-2026-271170 https://cve.radiocsirt.org/vuln/euvd-2026-271170 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22728 <p>Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original &#34;strict&#34; or &#34;namespace-wide&#34; constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.</p> <p>Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original &#34;strict&#34; or &#34;namespace-wide&#34; constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22728 https://cve.radiocsirt.org/vuln/ghsa-465p-v42x-3fmj <p><strong>Affected:</strong> Go: github.com/bitnami-labs/sealed-secrets</p> <p>This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted `spec.template.metadata.annotations` on the input sealed secret.</p> <p>If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set `sealedsecrets.bitnami.com/cluster-wide=true` in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (`metadata.name`/`metadata.namespace`) and unsealing to recover the victim plaintext.</p> <p>## Relevant Links (Pinned)</p> <p>- Rotate handler uses `NewSealedSecret(..., secret)` after unsealing: https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/controller/controller.go#L560-L606 - Scope derivation reads secret annotations (`SecretScope`): https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go#L112-L122</p> <p>## Root Cause</p> <p>The rotate flow unseals the input sealed secret to a `Secret`, then reseals using `NewSealedSecret(..., secret)`.</p> <p>Because `SecretScope(secret)` is computed from secret annotations, and unsealing applies `spec.template` metadata onto the unsealed secret, an attacker can influence the scope of the rotated output by mutating template annotations on the rotate input.</p> <p>## Attack Path</p> <p>1. Attacker obtains a victim `SealedSecret` object (for example via read access to resources or logs) an…</p> <p><strong>Affected:</strong> Go: github.com/bitnami-labs/sealed-secrets</p> <p>This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted `spec.template.metadata.annotations` on the input sealed secret.</p> <p>If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set `sealedsecrets.bitnami.com/cluster-wide=true` in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (`metadata.name`/`metadata.namespace`) and unsealing to recover the victim plaintext.</p> <p>## Relevant Links (Pinned)</p> <p>- Rotate handler uses `NewSealedSecret(..., secret)` after unsealing: https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/controller/controller.go#L560-L606 - Scope derivation reads secret annotations (`SecretScope`): https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go#L112-L122</p> <p>## Root Cause</p> <p>The rotate flow unseals the input sealed secret to a `Secret`, then reseals using `NewSealedSecret(..., secret)`.</p> <p>Because `SecretScope(secret)` is computed from secret annotations, and unsealing applies `spec.template` metadata onto the unsealed secret, an attacker can influence the scope of the rotated output by mutating template annotations on the rotate input.</p> <p>## Attack Path</p> <p>1. Attacker obtains a victim `SealedSecret` object (for example via read access to resources or logs) an…</p> https://cve.radiocsirt.org/vuln/ghsa-465p-v42x-3fmj