CVE-2026-22822: Critical Flaw in External Secrets Operator Breaks Namespace Isolation

A critical CVE-2026-22822 vulnerability in the External Secrets Operator (CVSS 9.3) allows the getSecretKey templating function to fetch secrets across namespaces, potentially enabling privilege escalation, data exfiltration, and compromise of service accounts; maintainers removed the function and users should upgrade to v1.2.0 or apply policy-based mitigations (Kyverno/Kubewarden/OPA) until patched.