{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "external-secrets: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/external-secrets--external-secrets/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/external-secrets--external-secrets/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-26287/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-26287/",
   "title": "CVE-2026-26287 · external-secrets · disclosed",
   "content_text": "External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.",
   "date_published": "2026-10-06T15:31:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-26287/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-26287/",
   "title": "CVE-2026-26287 · external-secrets · fixed upstream (Go)",
   "content_text": "Fixed versions: github.com/external-secrets/external-secrets 1.3.2.",
   "date_published": "2026-10-06T15:31:56Z"
  }
 ]
}