Sealed Secrets
Monthly
The Bitnami Sealed Secrets controller (versions up to and including 0.38.4) turns its unauthenticated POST /v1/verify and /v1/rotate endpoints into a decryption oracle, letting an attacker with internal cluster network access — or a simple kubectl port-forward to port 8080 — recover the full plaintext of any sealed secret one character at a time. The flaw chains two weaknesses: spec.template.data is excluded from the AEAD authenticated-data label binding, so an attacker can replay a victim's metadata and encryptedData verbatim and substitute arbitrary Go template logic, and template execution errors are reflected directly in HTTP status codes (200 = success, 409 = failure), producing a reliable equality oracle. No public exploit code and no CISA KEV entry were associated with this CVE at the time of analysis, though the vendor has published a GitHub security advisory.
The Bitnami Sealed Secrets controller (versions up to and including 0.38.4) turns its unauthenticated POST /v1/verify and /v1/rotate endpoints into a decryption oracle, letting an attacker with internal cluster network access — or a simple kubectl port-forward to port 8080 — recover the full plaintext of any sealed secret one character at a time. The flaw chains two weaknesses: spec.template.data is excluded from the AEAD authenticated-data label binding, so an attacker can replay a victim's metadata and encryptedData verbatim and substitute arbitrary Go template logic, and template execution errors are reflected directly in HTTP status codes (200 = success, 409 = failure), producing a reliable equality oracle. No public exploit code and no CISA KEV entry were associated with this CVE at the time of analysis, though the vendor has published a GitHub security advisory.