fix(security): sanitize json.Unmarshal errors to prevent secret data … by moolen · Pull Request #5884 · external-secrets/external-secrets

moolen · 2026-01-26T14:36:48Z

prompt:

❯ i found a security issue: when creating a PushSecret, i find this in the status condition:                                                                                                                                                
                                                                                                                                                                                                                                            
  type=Ready                                                                                                                                                                                                                                
  message: 'set secret failed: could not write remote ref payload to target secretstore vault-secret-sync-eks: error unmarshalling incoming secret value: json: cannot unmarshal number 1231231231213132... into Go value of type        
  float64'                                                                                                                                                                                                                                  
                                                                                                                                                                                                                                            
  it exposes private key data as number here. please investigate and find where the issue is and propose a solution to fix it.               

---
[...] fumbulizing
---
                            
❯ please have a look at other occurrences where this may be relevant. it seems returning the raw error of json.Unmarshal is a unsafe operation as it may leak secret data.

sanitize json.Unmarshal errors to prevent secret data leakage.

When json.Unmarshal fails, Go includes the problematic value in the error message. These errors were propagated to PushSecret status conditions, exposing sensitive data via the Kubernetes API.

Example: A secret containing a numeric value like an API key or token ID:
Secret data: {"key": 1231231231213132}

When unmarshalled into map[string]any, this produces:
"json: cannot unmarshal number 1231231231213132 into Go value of type float64"

This error was stored in PushSecret.Status.Conditions[].Message, making the secret value readable by anyone with get permissions on PushSecrets.

Fixed by returning sanitized error messages that don't include the original json.Unmarshal error details.

Affected providers: vault, akeyless, scaleway, kubernetes, secretserver, volcengine

Problem Statement

What is the problem you're trying to solve?

Related Issue

Fixes #...

Proposed Changes

How do you like to solve the issue and why?

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

charts
release
testing
security
templating

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

This security fix sanitizes error messages from json.Unmarshal operations across six providers (vault, akeyless, scaleway, kubernetes, secretserver, volcengine) to prevent accidental exposure of secret values in Kubernetes API status conditions.

Changes:

Replaces raw json.Unmarshal errors with generic messages like "failed to unmarshal secret: invalid JSON format" instead of propagating original error text that may contain sensitive data
Applied consistently across GetSecretMap, PushSecret, DeleteSecret, and related methods
No changes to function signatures or control flow

Tests:

Added regression tests in vault and kubernetes providers to verify sensitive data is not leaked in error messages
Tests confirm that error messages contain expected generic text while excluding original secret values

coderabbitai · 2026-01-26T14:36:57Z

Walkthrough

Replaces direct json.Unmarshal errors with generic sanitized error messages across multiple secret provider implementations (Akeyless, Kubernetes, Scaleway, Secret Server, Vault, Volcengine) to prevent sensitive data leakage through error strings. Control flow remains unchanged. Updates corresponding test files with new error message expectations and adds security regression tests.

Changes

Cohort / File(s)	Change Summary
Akeyless Provider `providers/v1/akeyless/akeyless.go`, `providers/v1/akeyless/akeyless_test.go`	Replaces `json.Unmarshal` errors with generic "invalid JSON format" messages in SecretExists, PushSecret, and DeleteSecret; updates test error expectations.
Kubernetes Provider `providers/v1/kubernetes/client.go`, `providers/v1/kubernetes/client_test.go`	Sanitizes JSON unmarshal errors in getMapFromValues; adds security regression test cases verifying error messages do not leak secret data.
Scaleway Provider `providers/v1/scaleway/client.go`	Masks `json.Unmarshal` error with generic message in GetSecretMap.
Secret Server Provider `providers/v1/secretserver/client.go`	Replaces `json.Unmarshal` error with generic message in GetSecretMap.
Vault Provider `providers/v1/vault/client_push.go`, `providers/v1/vault/client_push_test.go`	Sanitizes `json.Unmarshal` errors in two locations during secret value processing; adds security regression tests for KV v1/v2 verifying no sensitive data leakage.
Volcengine Provider `providers/v1/volcengine/client.go`	Replaces `json.Unmarshal` errors with generic message in GetSecretMap and extractProperty.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…leakage When json.Unmarshal fails, Go includes the problematic value in the error message. These errors were propagated to PushSecret status conditions, exposing sensitive data via the Kubernetes API. Example: A secret containing a numeric value like an API key or token ID: Secret data: {"key": 8019210420527506405} When unmarshalled into map[string]any, this produces: "json: cannot unmarshal number 8019210420527506405 into Go value of type float64" This error was stored in PushSecret.Status.Conditions[].Message, making the secret value readable by anyone with get permissions on PushSecrets. Fixed by returning sanitized error messages that don't include the original json.Unmarshal error details. Affected providers: vault, akeyless, scaleway, kubernetes, secretserver, volcengine Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

…ssages Add tests to ensure json.Unmarshal errors don't leak sensitive secret data in error messages. Tests cover both code paths in PushSecret: - Unmarshalling incoming secret value for comparison - Unmarshalling the value to push Also adds a security regression check in the test loop that explicitly verifies error messages don't contain the secret data. Co-Authored-By: Claude <noreply@anthropic.com>

…r messages Add test to ensure json.Unmarshal errors in GetSecretMap don't leak sensitive secret data in error messages. The test verifies that when unmarshalling fails, the error message is sanitized to "failed to unmarshal secret: invalid JSON format" and doesn't contain the actual secret value. Co-Authored-By: Claude <noreply@anthropic.com>

sonarqubecloud · 2026-01-28T13:14:32Z

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

external-secrets#5884) * fix(security): sanitize json.Unmarshal errors to prevent secret data leakage When json.Unmarshal fails, Go includes the problematic value in the error message. These errors were propagated to PushSecret status conditions, exposing sensitive data via the Kubernetes API. Example: A secret containing a numeric value like an API key or token ID: Secret data: {"key": 8019210420527506405} When unmarshalled into map[string]any, this produces: "json: cannot unmarshal number 8019210420527506405 into Go value of type float64" This error was stored in PushSecret.Status.Conditions[].Message, making the secret value readable by anyone with get permissions on PushSecrets. Fixed by returning sanitized error messages that don't include the original json.Unmarshal error details. Affected providers: vault, akeyless, scaleway, kubernetes, secretserver, volcengine Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> * test(vault): add regression tests for secret data leakage in error messages Add tests to ensure json.Unmarshal errors don't leak sensitive secret data in error messages. Tests cover both code paths in PushSecret: - Unmarshalling incoming secret value for comparison - Unmarshalling the value to push Also adds a security regression check in the test loop that explicitly verifies error messages don't contain the secret data. Co-Authored-By: Claude <noreply@anthropic.com> * test(kubernetes): add regression test for secret data leakage in error messages Add test to ensure json.Unmarshal errors in GetSecretMap don't leak sensitive secret data in error messages. The test verifies that when unmarshalling fails, the error message is sanitized to "failed to unmarshal secret: invalid JSON format" and doesn't contain the actual secret value. Co-Authored-By: Claude <noreply@anthropic.com> --------- Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.2.1` → `1.3.2` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.3.2`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2) [Compare Source](external-secrets/external-secrets@v1.3.1...v1.3.2) Image: `ghcr.io/external-secrets/external-secrets:v1.3.2` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v1.3.1 by [@Skarlso](https://github.com/Skarlso) in [#5860](external-secrets/external-secrets#5860) - chore(chart): Add missing tests for readinessProbe by [@jcpunk](https://github.com/jcpunk) in [#5769](external-secrets/external-secrets#5769) - docs: Update FluxCD example by [@umizoom](https://github.com/umizoom) in [#5862](external-secrets/external-secrets#5862) - fix(ci): Removed the unused check for Windows in Makefile by [@HauptJ](https://github.com/HauptJ) in [#5870](external-secrets/external-secrets#5870) - docs(release): Add actual dates for EOL of 1.x releases in stability and support page by [@n4zukker](https://github.com/n4zukker) in [#5889](external-secrets/external-secrets#5889) - docs: Passbolt provider maintenance ownership by [@stripthis](https://github.com/stripthis) in [#5886](external-secrets/external-secrets#5886) - chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by [@stripthis](https://github.com/stripthis) in [#5887](external-secrets/external-secrets#5887) - fix(security): sanitize json.Unmarshal errors to prevent secret data … by [@moolen](https://github.com/moolen) in [#5884](external-secrets/external-secrets#5884) - fix: webhook initialization order by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5901](external-secrets/external-secrets#5901) - chore: Cleanup flags by [@evrardj-roche](https://github.com/evrardj-roche) in [#5845](external-secrets/external-secrets#5845) - fix: onepasswordsdk shared tenant by altering the provider in the client cache by [@Skarlso](https://github.com/Skarlso) in [#5921](external-secrets/external-secrets#5921) ##### Dependencies - chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5873](external-secrets/external-secrets#5873) - chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5877](external-secrets/external-secrets#5877) - chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5880](external-secrets/external-secrets#5880) - chore(deps): bump ubi9/ubi from `22e9573` to `1f84f5c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5871](external-secrets/external-secrets#5871) - chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5872](external-secrets/external-secrets#5872) - chore(deps): bump hashicorp/setup-terraform from [`93d5a27`](external-secrets/external-secrets@93d5a27) to [`dcc3150`](external-secrets/external-secrets@dcc3150) by [@dependabot](https://github.com/dependabot)\[bot] in [#5875](external-secrets/external-secrets#5875) - chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5876](external-secrets/external-secrets#5876) - chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5878](external-secrets/external-secrets#5878) - chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5874](external-secrets/external-secrets#5874) - chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5879](external-secrets/external-secrets#5879) - chore(deps): bump golang from `d9b2e14` to `98e6cff` by [@dependabot](https://github.com/dependabot)\[bot] in [#5907](external-secrets/external-secrets#5907) - chore(deps): bump alpine from `865b95f` to `2510918` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5914](external-secrets/external-secrets#5914) - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5909](external-secrets/external-secrets#5909) - chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5912](external-secrets/external-secrets#5912) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5910](external-secrets/external-secrets#5910) - chore(deps): bump hashicorp/setup-terraform from [`dcc3150`](external-secrets/external-secrets@dcc3150) to [`ce70bcf`](external-secrets/external-secrets@ce70bcf) by [@dependabot](https://github.com/dependabot)\[bot] in [#5911](external-secrets/external-secrets#5911) - chore(deps): bump ubi9/ubi from `1f84f5c` to `c8df11b` by [@dependabot](https://github.com/dependabot)\[bot] in [#5908](external-secrets/external-secrets#5908) - chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5915](external-secrets/external-secrets#5915) - chore(deps): bump alpine from `865b95f` to `2510918` by [@dependabot](https://github.com/dependabot)\[bot] in [#5906](external-secrets/external-secrets#5906) - chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5916](external-secrets/external-secrets#5916) - chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5917](external-secrets/external-secrets#5917) - chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5913](external-secrets/external-secrets#5913) #### New Contributors - [@umizoom](https://github.com/umizoom) made their first contribution in [#5862](external-secrets/external-secrets#5862) - [@HauptJ](https://github.com/HauptJ) made their first contribution in [#5870](external-secrets/external-secrets#5870) - [@n4zukker](https://github.com/n4zukker) made their first contribution in [#5889](external-secrets/external-secrets#5889) - [@stripthis](https://github.com/stripthis) made their first contribution in [#5886](external-secrets/external-secrets#5886) **Full Changelog**: <external-secrets/external-secrets@v1.3.1...v1.3.2> ### [`v1.3.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.1) [Compare Source](external-secrets/external-secrets@v1.2.1...v1.3.1) Image: `ghcr.io/external-secrets/external-secrets:v1.3.1` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl`  For a Full release please referre to <https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0>. This is a fix build for the docker publish flow. #### What's Changed ##### General - fix: ignore the in-toto manifest when promoting the docker build by [@Skarlso](https://github.com/Skarlso) in [#5859](external-secrets/external-secrets#5859) **Full Changelog**: <external-secrets/external-secrets@v1.3.0...v1.3.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://kubara.git.onstackit.cloud/STACKIT/kubara/pulls/250

external-secrets#5884) * fix(security): sanitize json.Unmarshal errors to prevent secret data leakage When json.Unmarshal fails, Go includes the problematic value in the error message. These errors were propagated to PushSecret status conditions, exposing sensitive data via the Kubernetes API. Example: A secret containing a numeric value like an API key or token ID: Secret data: {"key": 8019210420527506405} When unmarshalled into map[string]any, this produces: "json: cannot unmarshal number 8019210420527506405 into Go value of type float64" This error was stored in PushSecret.Status.Conditions[].Message, making the secret value readable by anyone with get permissions on PushSecrets. Fixed by returning sanitized error messages that don't include the original json.Unmarshal error details. Affected providers: vault, akeyless, scaleway, kubernetes, secretserver, volcengine Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> * test(vault): add regression tests for secret data leakage in error messages Add tests to ensure json.Unmarshal errors don't leak sensitive secret data in error messages. Tests cover both code paths in PushSecret: - Unmarshalling incoming secret value for comparison - Unmarshalling the value to push Also adds a security regression check in the test loop that explicitly verifies error messages don't contain the secret data. Co-Authored-By: Claude <noreply@anthropic.com> * test(kubernetes): add regression test for secret data leakage in error messages Add test to ensure json.Unmarshal errors in GetSecretMap don't leak sensitive secret data in error messages. The test verifies that when unmarshalling fails, the error message is sanitized to "failed to unmarshal secret: invalid JSON format" and doesn't contain the actual secret value. Co-Authored-By: Claude <noreply@anthropic.com> --------- Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Claude <noreply@anthropic.com>

github-project-automation bot added this to External Secrets Jan 26, 2026

github-actions bot added area/security Issues / Pull Requests related to security kind/bug Categorizes issue or PR as related to a bug. size/s labels Jan 26, 2026

moolen force-pushed the mj-fix-secret-leak branch from 4569152 to 5035f39 Compare January 26, 2026 14:39

github-actions bot added the size/m label Jan 26, 2026

moolen and others added 3 commits January 26, 2026 16:05

moolen force-pushed the mj-fix-secret-leak branch from fb49ade to fd63d84 Compare January 26, 2026 15:05

moolen marked this pull request as ready for review January 26, 2026 19:12

Merge branch 'main' into mj-fix-secret-leak

27c0b30

Skarlso approved these changes Jan 28, 2026

View reviewed changes

moolen merged commit 324af19 into main Jan 29, 2026
29 checks passed

github-project-automation bot moved this to Done in External Secrets Jan 29, 2026

moolen deleted the mj-fix-secret-leak branch January 29, 2026 12:28

coderabbitai bot mentioned this pull request Mar 6, 2026

feat(providers): Implement PushSecret for Delinea Secret Server #6031

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security): sanitize json.Unmarshal errors to prevent secret data …#5884

fix(security): sanitize json.Unmarshal errors to prevent secret data …#5884
moolen merged 4 commits intomainfrom
mj-fix-secret-leak

moolen commented Jan 26, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

moolen commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Format

Checklist

Uh oh!

coderabbitai bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

sonarqubecloud bot commented Jan 28, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

moolen commented Jan 26, 2026 •

edited

Loading

coderabbitai bot commented Jan 26, 2026 •

edited

Loading