Cluster add-ons

External Secrets: what changed

In the last 90 days, 8 summarized changes: 1 security advisories, 7 releases. Stackdiff reads External Secrets's own feeds (external-secrets.io) and writes two sentences per change with a link to the source; it never republishes release notes. Sources last checked .

Needs attention

Breaking changes, security advisories, end-of-life and license changes from the last 90 days, worst first.

2.9.0Securitymedium
v2.9.0

Latest changes

Newest first, every type. Releases and fixes sit below anything that can hurt you in the weekly brief; here they are in order.

2.10.0Release
helm-chart-2.10.0
2.10.0Release
v2.10.0
2.9.0Release
helm-chart-2.9.0
2.9.0Securitymedium
v2.9.0
2.8.0Release
helm-chart-2.8.0
2.8.0Release
v2.8.0
2.7.0Release
helm-chart-2.7.0
2.7.0Release
v2.7.0
2.6.0Release
helm-chart-2.6.0
2.6.0Release
v2.6.0
2.4.0Securitymedium
GHSA-wv26-88m5-6h59: External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
1.3.3-0.20260331202714-6800989bdc12Securitymedium
GHSA-r2pg-r6h7-crf3: External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Where Stackdiff reads External Secrets

Only what the vendor publishes for machines. Excerpts are capped, summaries are our own two sentences, and every line links back.

Get External Secrets changes in your Monday brief

Add External Secrets and the rest of your stack; breaking changes and CVEs go out the moment they're seen, everything else on Monday.

Get your first brief

Other cluster add-ons tools