CVE-2025-62159: 
Wolfi vulnerability analysis and mitigation

CVE-2025-62159 is an improper access control vulnerability in the BeyondTrust provider implementation of External Secrets Operator (ESO), allowing unauthorized cross-namespace Kubernetes secret access. It affects ESO versions 0.10.1 through 0.19.2 and was disclosed on October 10, 2025, via a GitHub Security Advisory. The vulnerability was patched in version 0.20.0. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-284 (Improper Access Control): the BeyondTrust provider in ESO retrieved Kubernetes secrets directly without validating the namespace context or verifying whether the secret store was a ClusterSecretStore or a namespace-scoped SecretStore. This allowed any actor with access to configure a SecretStore referencing the BeyondTrust provider to read secrets from arbitrary namespaces, bypassing Kubernetes namespace isolation. The fix in version 0.20.0 replaces the direct secret retrieval logic with the resolvers.SecretKeyRef utility, which enforces namespace validation and restricts cross-namespace access exclusively to ClusterSecretStore types (GitHub Advisory).

Successful exploitation allows an attacker or misconfigured resource to read Kubernetes secrets from namespaces other than the intended one, violating multi-tenant security boundaries. This can lead to unauthorized disclosure of sensitive credentials, service account tokens, API keys, and other secrets stored across the cluster. Secondary consequences include privilege escalation, lateral movement within the cluster, and potential full compromise of workloads dependent on the exposed secrets (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify a Kubernetes cluster running External Secrets Operator versions 0.10.1–0.19.2 with the BeyondTrust provider enabled.
2. Gain foothold: Obtain permissions to create or modify SecretStore or ExternalSecret resources in any namespace (e.g., via a compromised low-privilege service account or misconfigured RBAC).
3. Craft malicious SecretStore: Create a SecretStore resource using the BeyondTrust provider that references a secret (e.g., a BeyondTrust API credential) located in a different, higher-privileged namespace.
4. Trigger secret retrieval: Create an ExternalSecret resource that references the crafted SecretStore, causing ESO to fetch the target secret without namespace validation.
5. Exfiltrate secrets: Read the resulting Kubernetes Secret object created by ESO in the attacker-controlled namespace, which now contains credentials from the target namespace (GitHub Advisory).

• Kubernetes Audit Logs: Unexpected create or get events on Secret resources in sensitive namespaces by service accounts associated with the External Secrets Operator, particularly referencing the BeyondTrust provider.
• Resource Configuration: Presence of SecretStore resources using the BeyondTrust provider with a namespace field pointing to a namespace other than the store's own namespace, outside of ClusterSecretStore objects.
• ESO Operator Logs: Log entries from the ESO controller showing secret resolution requests crossing namespace boundaries via the BeyondTrust provider.
• Kubernetes Events: Unexpected ExternalSecret reconciliation events in namespaces that do not own the referenced SecretStore (GitHub Advisory).

Upgrade External Secrets Operator to version 0.20.0 or later, which replaces the vulnerable secret retrieval logic with the resolvers.SecretKeyRef utility enforcing namespace validation. As a temporary workaround for environments that cannot upgrade immediately, deploy a policy engine such as Kyverno or OPA/Gatekeeper to: (1) block use of the BeyondTrust provider entirely, or (2) enforce that the namespace field in (Cluster)SecretStore configurations may only be set when using a ClusterSecretStore. Additionally, review existing RBAC policies to restrict who can create or modify SecretStore and ExternalSecret resources (GitHub Advisory, Red Hat CVE).

The vulnerability was discovered and reported by moolen, a contributor to the External Secrets Operator project, and the advisory was published directly via the GitHub Security Advisory program. Red Hat has also tracked and acknowledged the vulnerability. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified (GitHub Advisory, Red Hat CVE).