CVE-2026-22728

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original "strict" or "namespace-wide" constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bitnami-labs/sealed-secrets/security/advisories/GHSA-465p-v42x-3fmj

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Bitnami Sealed Secrets es vulnerable a un ataque de ampliación de alcance durante el flujo de rotación de secretos (/v1/rotate). El gestor de rotación deriva el alcance de sellado para la salida recién cifrada de anotaciones no confiables spec.template.metadata.annotations presentes en el SealedSecret de entrada. Al enviar un SealedSecret víctima al endpoint de rotación con la anotación sealedsecrets.bitnami.com/cluster-wide=true inyectada en los metadatos de la plantilla, un atacante remoto puede obtener una versión rotada del secreto que es a nivel de clúster. Esto elude las restricciones originales 'strict' o 'namespace-wide', permitiendo al atacante reorientar y desellar el secreto en cualquier espacio de nombres o bajo cualquier nombre para recuperar las credenciales en texto plano.

26 Feb 2026, 02:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-26 02:16

Updated : 2026-06-17 10:20

NVD link : CVE-2026-22728

Mitre link : CVE-2026-22728

CVE.ORG link : CVE-2026-22728

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-22728", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22728", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:58:00.603738Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Bitnami", "product": "sealed-secrets", "versions": [{"status": "affected", "version": "0.35.0", "lessThan": "<0.36.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-26T02:16:20.187", "references": [{"url": "https://github.com/bitnami-labs/sealed-secrets/security/advisories/GHSA-465p-v42x-3fmj", "source": "security@vmware.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Bitnami Sealed Secrets\u00a0is vulnerable to a scope-widening attack during\nthe secret rotation (/v1/rotate) flow. The rotation handler derives the\nsealing scope for the newly encrypted output from untrusted\nspec.template.metadata.annotations present in the input SealedSecret.\nBy submitting a victim SealedSecret to the rotate endpoint with the\nannotation sealedsecrets.bitnami.com/cluster-wide=true injected into the\ntemplate metadata, a remote attacker can obtain a rotated version of the\nsecret that is cluster-wide. This bypasses original \"strict\" or\n\"namespace-wide\" constraints, allowing the attacker to retarget and unseal\nthe secret in any namespace or under any name to recover the plaintext\ncredentials."}, {"lang": "es", "value": "Bitnami Sealed Secrets es vulnerable a un ataque de ampliaci\u00f3n de alcance durante el flujo de rotaci\u00f3n de secretos (/v1/rotate). El gestor de rotaci\u00f3n deriva el alcance de sellado para la salida reci\u00e9n cifrada de anotaciones no confiables spec.template.metadata.annotations presentes en el SealedSecret de entrada. Al enviar un SealedSecret v\u00edctima al endpoint de rotaci\u00f3n con la anotaci\u00f3n sealedsecrets.bitnami.com/cluster-wide=true inyectada en los metadatos de la plantilla, un atacante remoto puede obtener una versi\u00f3n rotada del secreto que es a nivel de cl\u00faster. Esto elude las restricciones originales 'strict' o 'namespace-wide', permitiendo al atacante reorientar y desellar el secreto en cualquier espacio de nombres o bajo cualquier nombre para recuperar las credenciales en texto plano."}], "lastModified": "2026-06-17T10:20:18.457", "sourceIdentifier": "security@vmware.com"}