external-secrets — Vulnerabilities & Security Advisories 5

External-secrets is a Kubernetes operator designed to manage external secret stores, enabling secure integration with services like AWS Secrets Manager, HashiCorp Vault, and Azure Key Vault. Historically, it has been susceptible to multiple remote code execution vulnerabilities due to unsafe deserialization and improper input validation, along with privilege escalation flaws through insecure default configurations. The project has also faced cross-site scripting issues in its web interface. While no major public security incidents have been documented, the five CVEs highlight risks in how secrets are fetched and processed, particularly when handling untrusted input or misconfigured access controls.