CVE-2026-26287
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-26287 is a high-severity Incorrect Behavior Order (CWE-696) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-93468
Vulnerability Data
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`)…
more
after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates security in the SDLC including secure coding, requirements, checkpoints, testing and developer training that can catch and stop incorrect behavior ordering before it reaches production, but this is only a minority slice of the weakness class (most instances arise from implementation errors not governed by process mandates).
Secure system architecture and engineering principles require proper ordering of design and implementation steps.
Secure coding standards enforce correct execution order of security-critical operations.
Security testing can detect ordering flaws but does not prevent them during development.