Security readout for executives and security teams
Plain-English summary
CVE-2026-22728 affects Bitnami Sealed Secrets 0.35.0. A user with high privileges can abuse the secret rotation endpoint so a rotated secret becomes usable cluster-wide, rather than staying restricted to its original namespace or name. This can expose plaintext credentials if the attacker can submit a victim SealedSecret for rotation.
Executive priority
Treat as a targeted credential exposure risk, not a mass internet emergency. Prioritize clusters where Sealed Secrets protects production credentials and many users or CI jobs can rotate SealedSecrets.
Technical view
The /v1/rotate flow derives the new sealing scope from untrusted spec.template.metadata.annotations in the submitted SealedSecret. Injecting sealedsecrets.bitnami.com/cluster-wide=true can convert a strict or namespace-wide SealedSecret into cluster-wide output, allowing retargeting and unsealing outside the original constraints. CVSS is 4.9, with network access, low complexity, and high privileges required.
Likely exposure
Exposure is limited to environments running Bitnami sealed-secrets version 0.35.0 where users or services can access the rotation endpoint with sufficient privileges and submit SealedSecret objects for rotation.
Exploitation context
The CVE record does not indicate CISA KEV listing or active exploitation. The attacker needs high privileges, but successful abuse can reveal sensitive credentials by widening the sealing scope during rotation.
Researcher notes
The issue is an authorization/scope-trust flaw classified as CWE-284. The vulnerable behavior is specific to rotation deriving scope from attacker-controlled template annotations. The provided sources name version 0.35.0 as affected and default status as unaffected for others; no exploit-in-the-wild evidence is provided.
Mitigation direction
- Review the GitHub security advisory and Bitnami guidance for fixed versions or official workarounds.
- Restrict access to the /v1/rotate endpoint to trusted administrators only.
- Audit RBAC permissions for users and automation allowed to rotate SealedSecrets.
- Avoid rotating untrusted or externally supplied SealedSecret manifests until remediated.
- Monitor for template annotations setting sealedsecrets.bitnami.com/cluster-wide=true unexpectedly.
Validation and detection
- Inventory sealed-secrets deployments and identify any running version 0.35.0.
- Review API access logs for rotate endpoint usage by non-administrative identities.
- Inspect SealedSecret templates for unexpected cluster-wide scope annotations.
- Verify RBAC limits rotation permissions to intended privileged users or service accounts.
- Confirm remediation status against the referenced GitHub advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22728 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N1.23.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.9MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.