Short answer: before version 2.13.0, yes, in some configurations. Advisory GHSA-v6x5-m838-gqph (CVE-2026-109546) says that a user who can only create ExternalSecret resources could escalate privileges. That user could make External Secrets Operator (ESO) create a Secret that Kubernetes fills with a long-lived token for a service account, and so impersonate any service account in that namespace. Versions 2.4.0 through 2.12.0 are listed as affected, and 2.13.0 contains the fix. Upgrade first, then check who may create ExternalSecrets. The advisory rates the issue moderate (CVSS 4.9, high attack complexity, low privileges required), because the attacker needs permissions that are already close to powerful.

This article is based on the advisories, release notes, source code and documentation, all opened on October 27, 2026. We did not have a cluster, did not reproduce the issue and did not test any command below. Snippets marked "untested" are our own drafts.…