https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:35:05 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-59341 <p>A security vulnerability exists in the Sealed Secrets controller&#39;s unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full plaintext of any sealed secret.</p> <p>The POST /v1/verify and /v1/rotate handlers call Unseal() to decrypt target secrets, then render any Go templates found in spec.template.data.* using the decrypted payload as the evaluation context (pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go). Errors encountered during template execution are directly reflected in the resulting HTTP response status codes.</p> <p>Missing AEAD label binding: the spec.template.data field is omitted from the AEAD authenticated-data label binding ciphertext to metadata. As a result, an attacker can copy a target&#39;s valid metadata and encryptedData verbatim, satisfying AEAD decryption and label validation, while freely replacing spec.template.data with arbitrary template logic.</p> <p>Side-channel oracle: template execution errors map directly to HTTP response codes. HTTP 200 (OK) indicates template execution succeeded; HTTP 409 (Conflict) indicates template execution failed (e.g. via {{ fail &#34;...&#34; }}).</p> <p>By injecting conditional statements such as {{ if eq (substr 0 1 .password) &#34;S&#34; }}ok{{ else }}{{ fail &#34;x&#34; }}{{ end }}, an attacker receives an HTTP 200 status when a character guess is correct and an HTTP 409 when…</p> <p>A security vulnerability exists in the Sealed Secrets controller&#39;s unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full plaintext of any sealed secret.</p> <p>The POST /v1/verify and /v1/rotate handlers call Unseal() to decrypt target secrets, then render any Go templates found in spec.template.data.* using the decrypted payload as the evaluation context (pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go). Errors encountered during template execution are directly reflected in the resulting HTTP response status codes.</p> <p>Missing AEAD label binding: the spec.template.data field is omitted from the AEAD authenticated-data label binding ciphertext to metadata. As a result, an attacker can copy a target&#39;s valid metadata and encryptedData verbatim, satisfying AEAD decryption and label validation, while freely replacing spec.template.data with arbitrary template logic.</p> <p>Side-channel oracle: template execution errors map directly to HTTP response codes. HTTP 200 (OK) indicates template execution succeeded; HTTP 409 (Conflict) indicates template execution failed (e.g. via {{ fail &#34;...&#34; }}).</p> <p>By injecting conditional statements such as {{ if eq (substr 0 1 .password) &#34;S&#34; }}ok{{ else }}{{ fail &#34;x&#34; }}{{ end }}, an attacker receives an HTTP 200 status when a character guess is correct and an HTTP 409 when…</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-59341