6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34984

CVE-2026-34984: External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Summary

The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap() and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secret-derived values, creating a DNS exfiltration primitive.

Impact

This is a confidentiality issue. In environments where untrusted or lower-trust users can author templated ExternalSecret resources and the controller can perform DNS resolution, fetched secret material can be exfiltrated through DNS without requiring direct outbound access from the attacker’s workload.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34984

CVE-2026-34984:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/external-secrets/external-secrets	go	< 1.3.3-0.20260331202714-6800989bdc12	1.3.3-0.20260331202714-6800989bdc12
github.com/external-secrets/external-secrets	go	>= 2.0.0, <= 2.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the v2 template engine of the External Secrets Operator, specifically in how it initializes the available template functions. The init function in runtime/template/v2/template.go is responsible for preparing the function map for the template engine. It uses the Sprig library but is intended to remove functions that could be dangerous in the context of processing secrets. The vulnerability was introduced because while the env and expandenv functions were removed, the getHostByName function was not. This allowed an attacker with permissions to create or update ExternalSecret resources with templates to use the getHostByName function. When the runtime/template/v2.Execute function processes such a template, it would perform a DNS lookup for a domain controlled by the attacker, with secret data included in the DNS query. This provides a channel for exfiltrating secrets from the environment where the External Secrets Operator is running. The patch addresses the root cause by explicitly removing getHostByName from the function map in the init function.

Vulnerable functions

runtime/template/v2.init

runtime/template/v2/template.go

This function initializes the template function map. Before the patch, it failed to remove the `getHostByName` function from the Sprig function map, making it available to templates and allowing for DNS-based secret exfiltration.

runtime/template/v2.Execute

runtime/template/v2/template.go

This function executes a user-provided template. If the template contains a call to the `getHostByName` function (which was available before the patch in the `init` function), this function would trigger the DNS lookup with potentially secret data, leading to exfiltration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.