{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-22728",
        "tracking": {
            "current_release_date": "2026-03-28T18:47:50.334102Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-22728",
            "initial_release_date": "2026-02-26T01:38:39.848088Z",
            "revision_history": [
                {
                    "date": "2026-02-26T01:38:39.848088Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-02-26T01:38:50.459165Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-02-26T02:24:54.760719Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-02-26T02:25:01.107192Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-26T07:35:25.074096Z",
                    "number": "5",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-26T12:06:59.403977Z",
                    "number": "6",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (2)."
                },
                {
                    "date": "2026-02-26T12:07:12.932727Z",
                    "number": "7",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-26T14:14:45.597712Z",
                    "number": "8",
                    "summary": "Source created.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-02-26T16:46:42.955935Z",
                    "number": "9",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-02-26T23:39:50.164326Z",
                    "number": "10",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)."
                },
                {
                    "date": "2026-02-26T23:39:53.374811Z",
                    "number": "11",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-02-27T06:12:38.308492Z",
                    "number": "12",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4).| CWES updated (1)."
                },
                {
                    "date": "2026-03-20T09:58:19.430967Z",
                    "number": "13",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-20T09:58:21.447339Z",
                    "number": "14",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-25T18:13:53.008232Z",
                    "number": "15",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (4)."
                },
                {
                    "date": "2026-03-25T18:13:54.911202Z",
                    "number": "16",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-28T18:47:40.923434Z",
                    "number": "17",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (2).| References created (6).| CWES updated (1)."
                }
            ],
            "status": "interim",
            "version": "17"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.36.0",
                                "product": {
                                    "name": "vers:unknown/0.36.0",
                                    "product_id": "CSAFPID-5958870"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<0.36.0",
                                "product": {
                                    "name": "vers:unknown/<0.36.0",
                                    "product_id": "CSAFPID-5958871"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "go/github.com/bitnami-labs/sealed-secrets"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<0.36.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<0.36.0",
                                    "product_id": "CSAFPID-5734388"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "sealed-secrets"
                    }
                ],
                "category": "vendor",
                "name": "bitnami-labs"
            },
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.35.0|<<0.36.0",
                                "product": {
                                    "name": "vers:unknown/0.35.0|<<0.36.0",
                                    "product_id": "CSAFPID-5723427"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<0.36.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<0.36.0",
                                    "product_id": "CSAFPID-5729823"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "sealed-secrets"
                    }
                ],
                "category": "vendor",
                "name": "Bitnami"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-22728",
            "notes": [
                {
                    "category": "description",
                    "text": "Bitnami Sealed Secrets is vulnerable to a scope-widening attack during\nthe secret rotation (/v1/rotate) flow. The rotation handler derives the\nsealing scope for the newly encrypted output from untrusted\nspec.template.metadata.annotations present in the input SealedSecret.\nBy submitting a victim SealedSecret to the rotate endpoint with the\nannotation sealedsecrets.bitnami.com/cluster-wide=true injected into the\ntemplate metadata, a remote attacker can obtain a rotated version of the\nsecret that is cluster-wide. This bypasses original \"strict\" or\n\"namespace-wide\" constraints, allowing the attacker to retarget and unseal\nthe secret in any namespace or under any name to recover the plaintext\ncredentials.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-22728"
                },
                {
                    "category": "description",
                    "text": "Bitnami Sealed Secrets is vulnerable to a scope-widening attack during\nthe secret rotation (/v1/rotate) flow. The rotation handler derives the\nsealing scope for the newly encrypted output from untrusted\nspec.template.metadata.annotations present in the input SealedSecret.\nBy submitting a victim SealedSecret to the rotate endpoint with the\nannotation sealedsecrets.bitnami.com/cluster-wide=true injected into the\ntemplate metadata, a remote attacker can obtain a rotated version of the\nsecret that is cluster-wide. This bypasses original \"strict\" or\n\"namespace-wide\" constraints, allowing the attacker to retarget and unseal\nthe secret in any namespace or under any name to recover the plaintext\ncredentials.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-22728"
                },
                {
                    "category": "description",
                    "text": "Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original \"strict\" or \"namespace-wide\" constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Bitnami%2FBIT-sealed-secrets-2026-22728.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted `spec.template.metadata.annotations` on the input sealed secret.\n\nIf a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set `sealedsecrets.bitnami.com/cluster-wide=true` in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (`metadata.name`/`metadata.namespace`) and unsealing to recover the victim plaintext.\n\n## Relevant Links (Pinned)\n\n- Rotate handler uses `NewSealedSecret(..., secret)` after unsealing: https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/controller/controller.go#L560-L606\n- Scope derivation reads secret annotations (`SecretScope`): https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go#L112-L122\n\n## Root Cause\n\nThe rotate flow unseals the input sealed secret to a `Secret`, then reseals using `NewSealedSecret(..., secret)`.\n\nBecause `SecretScope(secret)` is computed from secret annotations, and unsealing applies `spec.template` metadata onto the unsealed secret, an attacker can influence the scope of the rotated output by mutating template annotations on the rotate input.\n\n## Attack Path\n\n1. Attacker obtains a victim `SealedSecret` object (for example via read access to resources or logs) and can submit it to the controller rotate endpoint.\n2. Attacker sets `spec.template.metadata.annotations.sealedsecrets.bitnami.com/cluster-wide=true` (and optionally retargets name/namespace fields).\n3. Rotate returns a resealed, cluster-wide sealed secret that is no longer bound to the victim name/namespace.\n4. Attacker unseals the rotated output in their chosen namespace/name to recover the victim plaintext.\n\n## Proof of Concept\n\nSetup + run:\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake test\n```\n\nCanonical output (excerpt):\n\n```\n[CALLSITE_HIT]: pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go:112 SecretScope\n[PROOF_MARKER]: scope_widened=true rotated_scope=cluster-wide\n```\n\nControl output (excerpt):\n\n```\n[NC_MARKER]: scope_widened=false strict_scope_preserved=true\n```\n\n## Fix Accepted When\n\nRotate preserves the original sealing scope and does not allow scope widening based on untrusted template metadata; strict or namespace-wide inputs cannot produce cluster-wide outputs.\n\n[poc.zip](https://github.com/user-attachments/files/25080027/poc.zip)\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/25080028/PR_DESCRIPTION.md)\n[attack_scenario.md](https://github.com/user-attachments/files/25080029/attack_scenario.md)",
                    "title": "github - https://github.com/advisories/GHSA-465p-v42x-3fmj"
                },
                {
                    "category": "description",
                    "text": "This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted `spec.template.metadata.annotations` on the input sealed secret.\n\nIf a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set `sealedsecrets.bitnami.com/cluster-wide=true` in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (`metadata.name`/`metadata.namespace`) and unsealing to recover the victim plaintext.\n\n## Relevant Links (Pinned)\n\n- Rotate handler uses `NewSealedSecret(..., secret)` after unsealing: https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/controller/controller.go#L560-L606\n- Scope derivation reads secret annotations (`SecretScope`): https://github.com/bitnami-labs/sealed-secrets/blob/946bc048f3407117c837da6e4300686522d4c4eb/pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go#L112-L122\n\n## Root Cause\n\nThe rotate flow unseals the input sealed secret to a `Secret`, then reseals using `NewSealedSecret(..., secret)`.\n\nBecause `SecretScope(secret)` is computed from secret annotations, and unsealing applies `spec.template` metadata onto the unsealed secret, an attacker can influence the scope of the rotated output by mutating template annotations on the rotate input.\n\n## Attack Path\n\n1. Attacker obtains a victim `SealedSecret` object (for example via read access to resources or logs) and can submit it to the controller rotate endpoint.\n2. Attacker sets `spec.template.metadata.annotations.sealedsecrets.bitnami.com/cluster-wide=true` (and optionally retargets name/namespace fields).\n3. Rotate returns a resealed, cluster-wide sealed secret that is no longer bound to the victim name/namespace.\n4. Attacker unseals the rotated output in their chosen namespace/name to recover the victim plaintext.\n\n## Proof of Concept\n\nSetup + run:\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake test\n```\n\nCanonical output (excerpt):\n\n```\n[CALLSITE_HIT]: pkg/apis/sealedsecrets/v1alpha1/sealedsecret_expansion.go:112 SecretScope\n[PROOF_MARKER]: scope_widened=true rotated_scope=cluster-wide\n```\n\nControl output (excerpt):\n\n```\n[NC_MARKER]: scope_widened=false strict_scope_preserved=true\n```\n\n## Fix Accepted When\n\nRotate preserves the original sealing scope and does not allow scope widening based on untrusted template metadata; strict or namespace-wide inputs cannot produce cluster-wide outputs.\n\n[poc.zip](https://github.com/user-attachments/files/25080027/poc.zip)\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/25080028/PR_DESCRIPTION.md)\n[attack_scenario.md](https://github.com/user-attachments/files/25080029/attack_scenario.md)",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-465p-v42x-3fmj.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations in github.com/bitnami-labs/sealed-secrets",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4565.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "This report shows a scope-widening issue in the rotate (re-encrypt) flow: the output scope can be derived from untrusted `spec.template.metadata.annotations` on the input sealed secret.\n\nIf a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can set `sealedsecrets.bitnami.com/cluster-wide=true` in the template metadata and receive a rotated sealed secret that is cluster-wide, enabling retargeting (`metadata.name`/`metadata.namespace`) and unsealing to recover the victim plaintext.",
                    "title": "gitlab - https://gitlab.com/api/v4/projects/25847700/repository/files/go%2Fgithub.com%2Fbitnami-labs%2Fsealed-secrets%2FCVE-2026-22728.yml/raw"
                },
                {
                    "category": "other",
                    "text": "0.0005",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.9",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "There is cwe data available from source Nvd, There is cwe data available from source Github",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "fixed": [
                    "CSAFPID-5958870"
                ],
                "known_affected": [
                    "CSAFPID-5723427",
                    "CSAFPID-5729823",
                    "CSAFPID-5734388",
                    "CSAFPID-5958871"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-22728"
                },
                {
                    "category": "external",
                    "summary": "Source raw - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22728.json"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22728"
                },
                {
                    "category": "external",
                    "summary": "Source raw - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-22728"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Bitnami%2FBIT-sealed-secrets-2026-22728.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22728"
                },
                {
                    "category": "external",
                    "summary": "Source raw - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://github.com/advisories/GHSA-465p-v42x-3fmj"
                },
                {
                    "category": "external",
                    "summary": "Source raw - github",
                    "url": "https://api.github.com/advisories/GHSA-465p-v42x-3fmj"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-465p-v42x-3fmj.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4565.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - gitlab",
                    "url": "https://gitlab.com/api/v4/projects/25847700/repository/files/go%2Fgithub.com%2Fbitnami-labs%2Fsealed-secrets%2FCVE-2026-22728.yml/raw"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv",
                    "url": "https://github.com/bitnami-labs/sealed-secrets/security/advisories/GHSA-465p-v42x-3fmj"
                },
                {
                    "category": "external",
                    "summary": "Reference - osv",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-22728"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; gitlab; osv",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22728"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; gitlab; osv",
                    "url": "https://github.com/bitnami-labs/sealed-secrets/commit/d57ee4a8357d250e602b995399b525496ab688c1"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; gitlab; osv",
                    "url": "https://github.com/bitnami-labs/sealed-secrets/releases/tag/v0.36.0"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; gitlab",
                    "url": "https://github.com/advisories/GHSA-465p-v42x-3fmj"
                },
                {
                    "category": "external",
                    "summary": "Reference - gitlab",
                    "url": "https://github.com/bitnami-labs/sealed-secrets"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
                        "baseScore": 4.9,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-5723427",
                        "CSAFPID-5729823",
                        "CSAFPID-5734388",
                        "CSAFPID-5958871"
                    ]
                }
            ],
            "title": "CVE-2026-22728"
        }
    ]
}