CVE-2026-42876 — External Secrets Operator reads information from a

title: Free Tier: External Secrets Operator Secret Creation - CVE-2026-42876
id: scw-2026-05-11-ai-1
status: experimental
level: high
description: |
  This rule detects the creation of Kubernetes Secrets by the External Secrets Operator (ESO) in versions prior to 2.4.1. An unauthenticated user with permissions to create ExternalSecret resources can exploit this to create a Secret that is automatically populated with a long-lived token for a specified service account, effectively allowing impersonation. This rule specifically looks for the ESO binary being executed with a common configuration flag that might be present during exploitation, combined with the creation of a Secret object implicitly handled by the operator.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42876/
tags:
  - attack.privilege_escalation
  - attack.t1078.001
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - '/external-secrets'
      CommandLine|contains:
          - '--enable-leader-election=false'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse