{"schema_version":"1.7.3","id":"GO-2025-3885","published":"2025-08-18T13:17:23Z","modified":"2025-08-18T13:57:17.878658Z","aliases":["CVE-2025-55196","GHSA-fcxq-v2r3-cc8h"],"summary":"External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets","details":"External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets","affected":[{"package":{"name":"github.com/external-secrets/external-secrets","ecosystem":"Go","purl":"pkg:golang/github.com/external-secrets/external-secrets"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.15.0"},{"fixed":"0.19.2"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2025-3885.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55196"},{"type":"FIX","url":"https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d"},{"type":"FIX","url":"https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1"},{"type":"FIX","url":"https://github.com/external-secrets/external-secrets/pull/5109"},{"type":"FIX","url":"https://github.com/external-secrets/external-secrets/pull/5133"}],"database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2025-3885"}}