CVE-2026-34984

[CVE catalog]

Severity

High · CVSS 7.1

Published

Apr 14, 2026, 1:48:41 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.26% · Oct 27, 2026

A flaw was found in External Secrets Operator. An attacker with the ability to create or update templated ExternalSecret resources can exploit a vulnerability in the v2 template engine. This flaw allows the attacker to use the getHostByName function to perform controller-side DNS lookups, leading to the exfiltration of sensitive secret material through DNS queries. This results in a confidentiality issue, as secret data can be leaked without requiring direct outbound network access from the attacker's workload. External Secrets Operator: github.com/external-secrets/external-secrets: External Secrets Operator: Information disclosure via DNS exfiltration in v2 template engine An attacker with permissions to create or update templated ExternalSecret resources in External Secrets Operator for Red Hat OpenShift can exploit a flaw in the v2 template engine. This allows for information disclosure of sensitive secret material through DNS exfiltration, particularly in environments where untrusted users can define templated ExternalSecret resources and the controller has DNS resolution capabilities. Red Hat Product Security team has rated this vulnerability as having the impact of Moderate as the attacker has to have privileges to exploit this vulnerability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.